PHP CVE-2024-4577 explained: the Windows flaw that let attackers run code

Some security flaws need years of research to find. This one came from an old problem that people thought was solved, coming back through a side door.

The short version

In June 2024, PHP released fixes for CVE-2024-4577. The bug let a stranger send a specially crafted web request to a Windows server running PHP in CGI mode and make it run commands of their choosing. The researcher who reported it, Orange Tsai of DEVCORE, found that an earlier fix from 2012 could be bypassed, and the severity was rated critical.

How it worked, without the jargon

In CGI mode, a web server hands requests to the PHP program, and the text in the web address can end up as options for it. That's risky, because an attacker could smuggle in a setting that makes PHP run code taken from the request itself. Years ago (the original issue dates from 2012), PHP added a safeguard to block exactly that.

The weakness was on the Windows side. Windows has a feature that automatically converts characters it doesn't recognise into the "closest match", known as best-fit mapping. In some regional language settings, a particular harmless-looking character was converted into a plain hyphen at the last moment. PHP's safeguard checked for hyphens before that conversion happened, so the disguised one sailed past, and then turned into a real option.

The result: an attacker could, in effect, tell your server to run their code, from outside, with no login.

How quickly it was abused

Once details were public, criminals moved fast. Security firms reported scanning and exploitation attempts within days of the disclosure, and some groups used it to deploy ransomware. This pattern is normal now: when a serious flaw is announced, assume that automated tools will be hunting for it almost immediately, so there's little time to "get round to it".

Who was exposed

• Windows servers running PHP through CGI. Some bundled setups, such as certain XAMPP installs, used this by default.
• Unpatched releases of the 8.1, 8.2 and 8.3 lines. The fixed versions were 8.1.29, 8.2.20 and 8.3.8.
• Unsupported versions (8.0 and older) were also affected and never received a fix, so the only answer is to upgrade.
• Not affected: Linux servers, and setups using PHP-FPM or Apache's module rather than CGI.

How to check your server

1. Which operating system? If it's Linux, this specific flaw doesn't apply. Windows, keep going.
2. Which PHP version? Run php -v and compare it with the fixed versions above, or with the newest release of your line.
3. How does PHP run? Look at your web server config. A handler that points at php-cgi.exe means CGI mode. A reference to FastCGI/PHP-FPM or an Apache module means a different setup.
4. Is the version still supported? Check the official supported versions page. If it's listed as end of life, plan an upgrade.
5. Look at the logs. Odd requests with unusual query strings starting with a hyphen or containing encoded characters around the time of disclosure deserve a closer look.

What to do

• Update PHP to a current, supported release.
• Move away from CGI mode to FastCGI or PHP-FPM if you can. It's both safer and faster.
• Keep the PHP and web server software in a patch routine, not an "if we remember" routine.
• If you were exposed and unpatched during that period, have someone check for signs of compromise: unfamiliar files, new accounts, odd scheduled tasks.

Strange errors from PHP on your site can be another clue to an unhealthy setup. Our guide to common PHP errors shows what the messages mean, and the security checklist covers keeping software current. Unsure whether your server is exposed? Checking exactly this is part of our audit.

Source: NVD: CVE-2024-4577