{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2024-058.pdf"
    },
    "title": "Vulnerabilities in PHP",
    "serial_number": "2024-058",
    "publish_date": "13-06-2024 17:33:40",
    "description": "On June 6, 2024, a critical vulnerability was identified in certain versions of PHP that could allow the execution of arbitrary code or disclosure of sensitive information on Windows systems using Apache and PHP-CGI. The vulnerability is currently being actively exploited, and several proof of concepts are available.<br>\n",
    "url_title": "2024-058",
    "content_markdown": "---\ntitle: 'Vulnerabilities in PHP'\nnumber: '2024-058'\nversion: '1.0'\noriginal_date: 'June 6, 2024'\ndate: 'June 13, 2024'\n---\n\n_History:_\n\n* _13/06/2024 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn June 6, 2024, a critical vulnerability was identified in certain versions of PHP that could allow the execution of arbitrary code or disclosure of sensitive information on Windows systems using Apache and PHP-CGI [1]. The vulnerability is currently being actively exploited, and several proof of concepts are available [2].\n\n# Technical details\n\nThe vulnerability, identified as **CVE-2024-4577**. with a CVSS score of 9.3 [3], affects certain PHP versions. When using Apache and PHP-CGI on Windows, if the system is configured to use specific code pages, Windows may utilise _Best-Fit_ behaviour to replace characters in the command line given to Win32 API functions. This behaviour can cause the PHP CGI module to misinterpret these characters as PHP options, potentially allowing a malicious user to pass options to the PHP binary being executed. This vulnerability could lead to the exposure of script source code or the execution of arbitrary PHP code on the server.\n\n# Affected Products\n\nThe vulnerability affects PHP versions:\n\n- 8.1.* before 8.1.29, \n- 8.2.* before 8.2.20, \n- 8.3.* before 8.3.8 when using Apache and PHP-CGI on Windows [1]\n\n# Recommendations\n\nIt is recommended to apply updates to the affected products as soon as possible.\n\n# References \n\n[1] <https://www.php.net/ChangeLog-8.php>\n\n[2] <https://github.com/watchtowrlabs/CVE-2024-4577>\n\n[3] <https://nvd.nist.gov/vuln/detail/CVE-2024-4577>\n\n\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>13/06/2024 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>On June 6, 2024, a critical vulnerability was identified in certain versions of PHP that could allow the execution of arbitrary code or disclosure of sensitive information on Windows systems using Apache and PHP-CGI [1]. The vulnerability is currently being actively exploited, and several proof of concepts are available [2].</p><h2 id=\"technical-details\">Technical details</h2><p>The vulnerability, identified as <strong>CVE-2024-4577</strong>. with a CVSS score of 9.3 [3], affects certain PHP versions. When using Apache and PHP-CGI on Windows, if the system is configured to use specific code pages, Windows may utilise <em>Best-Fit</em> behaviour to replace characters in the command line given to Win32 API functions. This behaviour can cause the PHP CGI module to misinterpret these characters as PHP options, potentially allowing a malicious user to pass options to the PHP binary being executed. This vulnerability could lead to the exposure of script source code or the execution of arbitrary PHP code on the server.</p><h2 id=\"affected-products\">Affected Products</h2><p>The vulnerability affects PHP versions:</p><ul><li>8.1.* before 8.1.29, </li><li>8.2.* before 8.2.20, </li><li>8.3.* before 8.3.8 when using Apache and PHP-CGI on Windows [1]</li></ul><h2 id=\"recommendations\">Recommendations</h2><p>It is recommended to apply updates to the affected products as soon as possible.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://www.php.net/ChangeLog-8.php\">https://www.php.net/ChangeLog-8.php</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://github.com/watchtowrlabs/CVE-2024-4577\">https://github.com/watchtowrlabs/CVE-2024-4577</a></p><p>[3] <a rel=\"noopener\" target=\"_blank\" href=\"https://nvd.nist.gov/vuln/detail/CVE-2024-4577\">https://nvd.nist.gov/vuln/detail/CVE-2024-4577</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}