Argument Injection in PHP-CGI
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 9.8epss 100%
from disclosure to weapon0 days
Published on NVDJun 9
1st PoCJan 13
metasploitJun 6
CISA KEV+3d
exploitation probability
100%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
146 public exploit(s)
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Not affected
5 products (299 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 7
Action required by CISAfederal deadline: 2024-07-03
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Researched and written with AI from the vendor advisory and public analysis, with the sources above. Always confirm the fixed version in the official advisory before acting.
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
PHP Group · PHPpublic PoCs found — 146
exploitdbwww.exploit-db.com/exploits/52331unverifiedgithubgithub.com/watchtowrlabs/CVE-2024-4577★ 321githubgithub.com/xcanwin/CVE-2024-4577-PHP-RCE★ 162githubgithub.com/TAM-K592/CVE-2024-4577★ 75githubgithub.com/Night-have-dreams/php-cgi-Injector★ 52githubgithub.com/11whoami99/CVE-2024-4577★ 43githubgithub.com/Chocapikk/CVE-2024-4577★ 35githubgithub.com/ZephrFish/CVE-2024-4577-PHP-RCE★ 33githubgithub.com/gh-ost00/CVE-2024-4577-RCE★ 25githubgithub.com/BTtea/CVE-2024-4577-RCE-PoC★ 25githubgithub.com/huseyinstif/CVE-2024-4577-Nuclei-Template★ 21githubgithub.com/gotr00t0day/CVE-2024-4577★ 11githubgithub.com/K3ysTr0K3R/CVE-2024-4577-EXPLOIT★ 10githubgithub.com/manuelinfosec/CVE-2024-4577★ 10githubgithub.com/l0n3m4n/CVE-2024-4577-RCE★ 7githubgithub.com/bibo318/CVE-2024-4577-RCE-ATTACK★ 5githubgithub.com/longhoangth18/CVE-2024-4577★ 5githubgithub.com/CirqueiraDev/MassExploit-CVE-2024-4577★ 5githubgithub.com/aavamin/cve-2024-4577★ 5githubgithub.com/0x20c/CVE-2024-4577-nuclei★ 5githubgithub.com/zomasec/CVE-2024-4577★ 4githubgithub.com/Sh0ckFR/CVE-2024-4577★ 4githubgithub.com/JeninSutradhar/CVE-2024-4577-checker★ 3githubgithub.com/ibrahmsql/CVE-2024-4577★ 3githubgithub.com/phirojshah/CVE-2024-4577★ 2githubgithub.com/d3ck4/Shodan-CVE-2024-4577★ 2githubgithub.com/byteReaper77/CVE-2024-4577★ 2githubgithub.com/VictorShem/CVE-2024-4577★ 2githubgithub.com/AlperenY-cs/CVE-2024-4577★ 2githubgithub.com/0XFFFF-XD/CVE-2024-4577-PHP-CGI-RCE★ 1githubgithub.com/Junp0/CVE-2024-4577★ 1githubgithub.com/gl1tch0x1/PHP_8.1.x_Exploit★ 1githubgithub.com/ggfzx/CVE-2024-4577★ 1githubgithub.com/sug4r-wr41th/CVE-2024-4577★ 1githubgithub.com/ywChen-NTUST/PHP-CGI-RCE-Scanner★ 1githubgithub.com/PhinehasNarh/CVE-2024-4577-LetsDefend-walkthrough★ 1githubgithub.com/taida957789/CVE-2024-4577★ 1githubgithub.com/Wh02m1/CVE-2024-4577★ 1githubgithub.com/Sysc4ll3r/CVE-2024-4577★ 1githubgithub.com/yeee3642/edu-recon★ 0githubgithub.com/Ianthinus/CVE-2024-4577★ 0githubgithub.com/Entropt/CVE-2024-4577_Analysis★ 0githubgithub.com/olebris/CVE-2024-4577★ 0githubgithub.com/charis3306/CVE-2024-4577★ 0githubgithub.com/r0otk3r/CVE-2024-4577★ 0githubgithub.com/NKTriS/HTSOC★ 0githubgithub.com/DuyDuongDuyDuong/CVE-2024-4577-Exploitation-AsyncRAT-Deployment-DFIR-Investigation★ 0githubgithub.com/dbyMelina/CVE-2024-4577★ 0githubgithub.com/Ra1n-60W/CVE-2024-4577★ 0githubgithub.com/wilss0n/CVE-2024-4577★ 0githubgithub.com/zjhzjhhh/CVE-2024-4577★ 0githubgithub.com/WanLiChangChengWanLiChang/CVE-2024-4577-RCE-EXP★ 0githubgithub.com/BLACK-ARCHIVERS/CVE-2024-4577★ 0githubgithub.com/jakabakos/CVE-2024-4577-PHP-CGI-argument-injection-RCE★ 0githubgithub.com/a-roshbaik/CVE-2024-4577★ 0githubgithub.com/a-roshbaik/CVE-2024-4577-PHP-RCE★ 0githubgithub.com/Jcccccx/CVE-2024-4577★ 0githubgithub.com/bughuntar/CVE-2024-4577★ 0githubgithub.com/ahmetramazank/CVE-2024-4577★ 0githubgithub.com/Didarul342/CVE-2024-4577★ 0githubgithub.com/mananjain61/PHP-CGI-INTERNAL-RCE★ 0githubgithub.com/Skycritch/CVE-2024-4577★ 0githubgithub.com/InfoSec-DB/PHPCGIScanner★ 0githubgithub.com/a1ex-var1amov/ctf-cve-2024-4577★ 0githubgithub.com/rayngnpc/CVE-2024-4577-rayng★ 0githubgithub.com/Kanak-CypherX/cve-2024-4577-lab★ 0githubgithub.com/khwajasaad267-coder/cve-2024-4577-lab★ 0githubgithub.com/graphite-org/CVE-2024-4577★ 0githubgithub.com/princew88/CVE-2024-4577★ 0githubgithub.com/bl4cksku11/CVE-2024-4577★ 0githubgithub.com/gmh5225/CVE-2024-4577-PHP-RCE★ 0githubgithub.com/AhmedMansour93/Event-ID-268-Rule-Name-SOC292-Possible-PHP-Injection-Detected-CVE-2024-4577-★ 0githubgithub.com/tpdlshdmlrkfmcla/php-cgi-cve-2024-4577★ 0githubgithub.com/Gill-Singh-A/CVE-2024-4577-Exploit★ 0githubgithub.com/KimJuhyeong95/cve-2024-4577★ 0githubgithub.com/tntrock/CVE-2024-4577_PowerShell★ 0githubgithub.com/razureink/cve-2024-4577-phpcgi_rce_reproduction★ 0githubgithub.com/Dejavu666/CVE-2024-4577★ 0vulncheckvulncheck.com/xdb/c8e637167f42unverifiedvulncheckvulncheck.com/xdb/975f3d4508fdunverifiedvulncheckvulncheck.com/xdb/c3ffd6462c70unverifiedvulncheckvulncheck.com/xdb/218b19f4d22eunverifiedvulncheckvulncheck.com/xdb/ed23c8ab0f6aunverifiedvulncheckvulncheck.com/xdb/d06e30d57aafunverifiedvulncheckvulncheck.com/xdb/c4c00e052574unverifiedvulncheckvulncheck.com/xdb/081170ce66e7unverifiedvulncheckvulncheck.com/xdb/c8c379f83d10unverifiedvulncheckvulncheck.com/xdb/64f14f4beecbunverifiedvulncheckvulncheck.com/xdb/cb830f9d202funverifiedvulncheckvulncheck.com/xdb/d982c4edc474unverifiedvulncheckvulncheck.com/xdb/0b2ec7cacbadunverifiedvulncheckvulncheck.com/xdb/ff0f9bccbf68unverifiedvulncheckvulncheck.com/xdb/a53150e5fe7bunverifiedvulncheckvulncheck.com/xdb/3e8fa83c20c9unverifiedvulncheckvulncheck.com/xdb/20d85040c310unverifiedvulncheckvulncheck.com/xdb/825b99bdb560unverifiedvulncheckvulncheck.com/xdb/56c6c80d0bc4unverifiedvulncheckvulncheck.com/xdb/bd76b0f41ae3unverifiedvulncheckvulncheck.com/xdb/e294281b4747unverifiedvulncheckvulncheck.com/xdb/64046c52ba42unverifiedvulncheckvulncheck.com/xdb/4f6effc389cdunverifiedvulncheckvulncheck.com/xdb/5a6770491004unverifiedvulncheckvulncheck.com/xdb/30f842b7c8c9unverifiedvulncheckvulncheck.com/xdb/1531cf762de4unverifiedvulncheckvulncheck.com/xdb/b914f202bec2unverifiedvulncheckvulncheck.com/xdb/024996c990ccunverifiedvulncheckvulncheck.com/xdb/48d0c04eff37unverifiedvulncheckvulncheck.com/xdb/94a35549d41eunverifiedvulncheckvulncheck.com/xdb/112f55c12274unverifiedvulncheckvulncheck.com/xdb/55023f1ef157unverifiedvulncheckvulncheck.com/xdb/bd5de034d60funverifiedvulncheckvulncheck.com/xdb/24731ac505a6unverifiedvulncheckvulncheck.com/xdb/fb1b068d71fbunverifiedvulncheckvulncheck.com/xdb/615662ae6addunverifiedvulncheckvulncheck.com/xdb/b4cc52bca529unverifiedvulncheckvulncheck.com/xdb/1b1ee9a9f8a3unverifiedvulncheckvulncheck.com/xdb/c81a2db7a37cunverifiedvulncheckvulncheck.com/xdb/148c9b11e6f8unverifiedvulncheckvulncheck.com/xdb/c24045f1f2b0unverifiedvulncheckvulncheck.com/xdb/3e908cfb9d26unverifiedvulncheckvulncheck.com/xdb/11c7d322fe03unverifiedvulncheckvulncheck.com/xdb/fa348e621ba5unverifiedvulncheckvulncheck.com/xdb/d943b0b2089bunverifiedvulncheckvulncheck.com/xdb/4b9a71f3a5cfunverifiedvulncheckvulncheck.com/xdb/eeb081100dd5unverifiedvulncheckvulncheck.com/xdb/293eaa222a74unverifiedvulncheckvulncheck.com/xdb/b2eb4bae1e05unverifiedvulncheckvulncheck.com/xdb/9e5daca09c8cunverifiedvulncheckvulncheck.com/xdb/912529ac004funverifiedvulncheckvulncheck.com/xdb/7ee6ed2bc73funverifiedvulncheckvulncheck.com/xdb/5d63cc33def4unverifiedvulncheckvulncheck.com/xdb/552c4106ae73unverifiedvulncheckvulncheck.com/xdb/0c4b91081cb3unverifiedvulncheckvulncheck.com/xdb/d89b163c7ba9unverifiedvulncheckvulncheck.com/xdb/7d0a6bcc1e48unverifiedvulncheckvulncheck.com/xdb/d3b12b49d03cunverifiedvulncheckvulncheck.com/xdb/7dd0ca311187unverifiedvulncheckvulncheck.com/xdb/aa3899b675a4unverifiedvulncheckvulncheck.com/xdb/cd32f509d4abunverifiedvulncheckvulncheck.com/xdb/1287f9a713c6unverifiedvulncheckvulncheck.com/xdb/acfef3dab7abunverifiedvulncheckvulncheck.com/xdb/cc11323372a3unverifiedvulncheckvulncheck.com/xdb/7a69cea7f16dunverifiedvulncheckvulncheck.com/xdb/5d24a3878ae0unverifiedvulncheckvulncheck.com/xdb/b2fa764f2781unverifiedvulncheckvulncheck.com/xdb/aed5b2a31554unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.htmlhttps://blog.talosintelligence.com/new-persistent-attacks-japan/https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediatelyhttps://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/https://github.com/11whoami99/CVE-2024-4577https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jvhttps://github.com/rapid7/metasploit-framework/pull/19247https://github.com/watchtowrlabs/CVE-2024-4577https://github.com/xcanwin/CVE-2024-4577-PHP-RCEhttps://isc.sans.edu/diary/30994https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/