PHP-CGI Argument Injection (Best-Fit)

aka CVE-2024-4577, CVE-2012-1823 bypass

Product: PHP Group PHP (CGI mode on Windows)
CVE: CVE-2024-4577
Disclosed: 2024-06-06
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: PHP 8.1 before 8.1.29, 8.2 before 8.2.20, 8.3 before 8.3.8 and all EOL branches, on Windows with PHP-CGI exposed (default XAMPP), confirmed on Chinese and Japanese code pages
Fixed: 8.1.29, 8.2.20, 8.3.8

Summary

Orange Tsai found that Windows 'Best-Fit' character conversion turns a soft hyphen (0xAD) in the query string into a regular '-', which revives the 2012 PHP-CGI argument injection. Attackers can pass -d options to php-cgi.exe and run PHP code without authentication. Default XAMPP installs on Windows were exploitable and the bug was mass-exploited by botnets and ransomware.

Root cause

PHP-CGI's fix for CVE-2012-1823 refused query strings starting with '-' so they would not be parsed as command-line options. On certain Windows code pages, the ANSI conversion of the command line maps 0xAD to 0x2D ('-') after PHP's check runs. So %AD in the query string becomes an option such as -d allow_url_include=1 -d auto_prepend_file=php://input, and the request body is executed as PHP.

Impact

Unauthenticated RCE on Windows servers running PHP in CGI mode (including XAMPP defaults).

Public PoC

# Query string shape seen in exploitation (body is PHP code):
POST /php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+-d+auto_prepend_file%3dphp://input HTTP/1.1

Source: watchTowr Labs / CVE-2024-4577 detection artifact

Detection

Web logs with query strings containing %AD followed by d+ or allow_url_include / auto_prepend_file; requests to /php-cgi/php-cgi.exe. Nuclei template CVE-2024-4577.

Mitigation

Upgrade PHP, move away from PHP-CGI (use FastCGI/PHP-FPM or mod_php), or apply the published rewrite rules that block %AD-prefixed query strings.