PRP: CVE-2024-4577 - PHP-CGI RCE

[LeonardoE95]

Hi there.

I would like to implement a plugin to detect a PHP-CGI RCE (CVE-2024-4577) affecting deployments of PHP that use Apache and that run on Windows, such as when using XAMPP, a popular platform for PHP development.

Specifically, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages (such as the Japanese locale), Windows may use "Best-Fit" behavior to replace characters in the command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to the PHP binary being run, allowing to achieve RCE.

This vulnerability affects the following versions of PHP installed on the Windows operating system:

Affected PHP Versions
PHP 8.3 < 8.3.8
PHP 8.2 < 8.2.20
PHP 8.1 < 8.1.29

References:
https://nvd.nist.gov/vuln/detail/cve-2024-4577
https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/
https://github.com/watchtowrlabs/CVE-2024-4577

Thanks.

[tooryx]

You can work on this.