CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability

KEVRansomware

Analyzed

AliasesCGA-gmwp-fhmg-pqfmCGA-p643-hjxc-p95cCGA-v39m-ww8v-h7fq+2 more

Published 09-06-2024Last modified 21-10-2025

Vulnerability summary

CVE-2024-4577 is a critical (CVSS 9.8) vulnerability in PHP Group PHP. It is known to be exploited: CISA lists it, first on 12-06-2024. It has been used in ransomware campaigns. EPSS estimates a 99.99% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 14 public exploits are recorded.

Priority

Act nowransomware

Known ransomware use (CISA, 12-06-2024)

Source freshness unavailable

How is this decided?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

99.99%

0%100%

Critical · 0.00 pp in 30 days

KEVExploited in the wildCritical · listed in 1 catalog

RansomwareKnown useFlagged by CISA

Public exploits14github, reference, exploit-database, metasploit

Advisory lineage

Upstream 0 · Downstream 1 · Related 4

OPENSUSE-SU-2024:14376-1 CGA-84J3-W824-WV4X CGA-GVWM-H3QQ-8679 CGA-PRG6-6RGX-HMX2

Timeline

09-06-2024
PublishedVulnerability first disclosed.
12-06-2024
Added to CISA KEVExploitedPHP-CGI OS Command Injection Vulnerability
03-07-2024
CISA remediation dueDeadline passedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
21-10-2025
Last modifiedVulnerability information updated.

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

CVSS metrics

5 scores · 5 sources · 1 version

v3.19.8

EPSS trend

Probability

99.99%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 99.99% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEVListed

Added: 12-06-2024
Federal due date: 03-07-2024

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. nvd.nist.gov/vuln/detail/CVE-2024-4577

Public exploits

14 found

githubUnverified
Php Src
Maturity: poc
githubUnverified
Cve 2024 4577
Maturity: poc
githubUnverified
Cve 2024 4577 Php Rce
Maturity: poc

Show all 14 exploits

githubUnverified
Metasploit Framework
Maturity: poc
githubUnverified
Cve 2024 4577
Maturity: poc
referenceUnverified
Exploit Reference (devco.re)
Maturity: unknown
referenceUnverified
Exploit Reference (arstechnica.com)
Maturity: unknown
referenceUnverified
Exploit Reference (labs.watchtowr.com)
Maturity: unknown
referenceUnverified
Exploit Reference (isc.sans.edu)
Maturity: unknown
referenceUnverified
Exploit Reference (vicarius.io)
Maturity: unknown
referenceUnverified
Exploit Reference (vicarius.io)
Maturity: unknown
referenceUnverified
Exploit Reference (blog.talosintelligence.com)
Maturity: unknown
exploit-databasephpUnverified
PHP CGI Module 8.3.4 - Remote Code Execution (RCE)
Maturity: poc
MetasploitremoteVerified
PHP CGI Argument Injection Remote Code Execution
exploit/windows/http/php_cgi_arg_injection_rce_cve_2024_4577
Maturity: weaponized

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS CommandThe product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Alpine3 products

php81< 8.1.29-r0
php82< 8.2.20-r0
php83< 8.3.8-r0

Chainguard2 products

php-8.1< 8.1.29-r0
php-8.2< 8.2.20-r0

Wolfi2 products

php-8.1< 8.1.29-r0
php-8.2< 8.2.20-r0

Fedoraproject1 product

fedoraEOL39 | 40

Php1 product

php≥ 8.1.0, < 8.1.29 | ≥ 8.2.0, < 8.2.20 | ≥ 8.3.0, < 8.3.8

Php group1 product

php≥ 8.1.*, < 8.1.29 | ≥ 8.2.*, < 8.2.20 | ≥ 8.3.*, < 8.3.8

6 vendors · 10 products

References

27 links

github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jvAdvisoryExploitThird Party Advisory
blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.htmlARTICLEThird Party Advisory
devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/ARTICLEExploitThird Party Advisory
arstechnica.com/security/…WEBExploitPress/Media CoverageThird Party Advisory
www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/ARTICLEThird Party Advisory
github.com/11whoami99/CVE-2024-4577PACKAGEExploit
github.com/xcanwin/CVE-2024-4577-PHP-RCEPACKAGEExploitThird Party Advisory
github.com/rapid7/metasploit-framework/pull/19247FIXExploitIssue TrackingPatch
labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/WEBExploitThird Party Advisory
github.com/watchtowrlabs/CVE-2024-4577PACKAGEExploitThird Party Advisory

Show all 27 references

www.php.net/ChangeLog-8.phpWEBRelease Notes
www.php.net/ChangeLog-8.phpWEBRelease Notes
www.php.net/ChangeLog-8.phpWEBRelease Notes
cert.be/en/advisory/warning-php-remote-code-execution-patch-immediatelyAdvisoryThird Party Advisory
isc.sans.edu/diary/30994WEBExploitThird Party Advisory
www.openwall.com/lists/oss-security/2024/06/07/1WEBMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…WEBMailing List
lists.fedoraproject.org/archives/…WEBMailing List
security.netapp.com/advisory/ntap-20240621-0008/AdvisoryThird Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577Government ResourceWEBUS Government Resource
www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577WEBExploitThird Party Advisory
www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577WEBExploitThird Party Advisory
blog.talosintelligence.com/new-persistent-attacks-japan/ARTICLEExploitThird Party Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4577.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2024-4577AdvisoryOval
github.com/php/php-srcPACKAGE
security.alpinelinux.org/vuln/CVE-2024-4577Advisory