CVE-2024-4577: fallo crítico en PHP
Argument Injection in PHP-CGI
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
100Vexday Risk Score
Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.
ssvc Actcvss 9.8epss 100%
de la publicación al armael mismo día
Publicada en NVD9 jun
1ª PoC13 ene
metasploit6 jun
CISA KEV+3d
Lo que declaran los fabricantes (VEX)
Declaraciones oficiales de los fabricantes en formato CSAF/VEX: si su producto está afectado, ya corregido o descartado — y por qué. Es afirmación del fabricante, no juicio de Vexday.
Red Hatdocumento VEX ↗
No afectado
5 productos (299 componentes) — porque el código vulnerable no está presente en el producto
Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 7
Acción exigida por CISAplazo federal: 2024-07-03
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
En resumen
PHP-CGI en Windows puede ser engañado para aceptar opciones malintencionadas de línea de comandos mediante trucos de codificación de caracteres, permitiendo que atacantes expongan código fuente o ejecuten código arbitrario en el servidor.
Detalle técnico
Una vulnerabilidad de inyección de argumentos en PHP-CGI en Windows ocurre cuando Apache pasa entrada del usuario a través de la interfaz CGI; si las configuraciones de página de códigos de Windows habilitan mapeo de caracteres 'Best-Fit', entrada especialmente diseñada puede ser reinterpretada como opciones PHP (por ejemplo, -r, -d), evitando el manejo normal de solicitudes. Requiere configuración específica de página de códigos de Windows y versiones PHP vulnerables; el impacto incluye ejecución arbitraria de código y divulgación de información.
Resumen generado y traducido por IA a partir de la descripción oficial.
El análisis completo de esta CVE está disponible en portugués →
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
PHP Group · PHPPoCs públicas encontradas — 156
exploitdbwww.exploit-db.com/exploits/52331no verificadogithubgithub.com/watchtowrlabs/CVE-2024-4577★ 324githubgithub.com/xcanwin/CVE-2024-4577-PHP-RCE★ 161githubgithub.com/TAM-K592/CVE-2024-4577★ 75githubgithub.com/Night-have-dreams/php-cgi-Injector★ 52githubgithub.com/11whoami99/CVE-2024-4577★ 43githubgithub.com/Chocapikk/CVE-2024-4577★ 35githubgithub.com/ZephrFish/CVE-2024-4577-PHP-RCE★ 33githubgithub.com/gh-ost00/CVE-2024-4577-RCE★ 25githubgithub.com/BTtea/CVE-2024-4577-RCE-PoC★ 25githubgithub.com/huseyinstif/CVE-2024-4577-Nuclei-Template★ 21githubgithub.com/gotr00t0day/CVE-2024-4577★ 11githubgithub.com/manuelinfosec/CVE-2024-4577★ 10githubgithub.com/K3ysTr0K3R/CVE-2024-4577-EXPLOIT★ 10githubgithub.com/l0n3m4n/CVE-2024-4577-RCE★ 7githubgithub.com/aavamin/cve-2024-4577★ 6githubgithub.com/bibo318/CVE-2024-4577-RCE-ATTACK★ 5githubgithub.com/CirqueiraDev/MassExploit-CVE-2024-4577★ 5githubgithub.com/0x20c/CVE-2024-4577-nuclei★ 5githubgithub.com/longhoangth18/CVE-2024-4577★ 4githubgithub.com/zomasec/CVE-2024-4577★ 4githubgithub.com/Sh0ckFR/CVE-2024-4577★ 4githubgithub.com/ibrahmsql/CVE-2024-4577★ 3githubgithub.com/JeninSutradhar/CVE-2024-4577-checker★ 3githubgithub.com/AlperenY-cs/CVE-2024-4577★ 2githubgithub.com/phirojshah/CVE-2024-4577★ 2githubgithub.com/byteReaper77/CVE-2024-4577★ 2githubgithub.com/d3ck4/Shodan-CVE-2024-4577★ 2githubgithub.com/VictorShem/CVE-2024-4577★ 2githubgithub.com/Junp0/CVE-2024-4577★ 1githubgithub.com/Wh02m1/CVE-2024-4577★ 1githubgithub.com/esskslifetech/PROTECTION2Shell★ 1githubgithub.com/taida957789/CVE-2024-4577★ 1githubgithub.com/PhinehasNarh/CVE-2024-4577-LetsDefend-walkthrough★ 1githubgithub.com/0XFFFF-XD/CVE-2024-4577-PHP-CGI-RCE★ 1githubgithub.com/esskslifetech/php-secure-patch★ 1githubgithub.com/gl1tch0x1/PHP_8.1.x_Exploit★ 1githubgithub.com/sug4r-wr41th/CVE-2024-4577★ 1githubgithub.com/Ghost-Bx1/php-exploits-CVE-2026-109618-CVE-2026-109619-CVE-2024-4577★ 1githubgithub.com/CyberDefenderAI/AI-Threat-Detection-PHP-CGI-Vulnerabilities★ 1githubgithub.com/ggfzx/CVE-2024-4577★ 1githubgithub.com/Sysc4ll3r/CVE-2024-4577★ 1githubgithub.com/ywChen-NTUST/PHP-CGI-RCE-Scanner★ 1githubgithub.com/bl4cksku11/CVE-2024-4577★ 0githubgithub.com/Ianthinus/CVE-2024-4577★ 0githubgithub.com/Entropt/CVE-2024-4577_Analysis★ 0githubgithub.com/olebris/CVE-2024-4577★ 0githubgithub.com/charis3306/CVE-2024-4577★ 0githubgithub.com/r0otk3r/CVE-2024-4577★ 0githubgithub.com/NKTriS/HTSOC★ 0githubgithub.com/DuyDuongDuyDuong/CVE-2024-4577-Exploitation-AsyncRAT-Deployment-DFIR-Investigation★ 0githubgithub.com/dbyMelina/CVE-2024-4577★ 0githubgithub.com/Ra1n-60W/CVE-2024-4577★ 0githubgithub.com/ahmetramazank/CVE-2024-4577★ 0githubgithub.com/tpdlshdmlrkfmcla/php-cgi-cve-2024-4577★ 0githubgithub.com/wilss0n/CVE-2024-4577★ 0githubgithub.com/Gill-Singh-A/CVE-2024-4577-Exploit★ 0githubgithub.com/KimJuhyeong95/cve-2024-4577★ 0githubgithub.com/razureink/cve-2024-4577-phpcgi_rce_reproduction★ 0githubgithub.com/kokilyadm/waffers★ 0githubgithub.com/zjhzjhhh/CVE-2024-4577★ 0githubgithub.com/WanLiChangChengWanLiChang/CVE-2024-4577-RCE-EXP★ 0githubgithub.com/a-roshbaik/CVE-2024-4577★ 0githubgithub.com/a-roshbaik/CVE-2024-4577-PHP-RCE★ 0githubgithub.com/Jcccccx/CVE-2024-4577★ 0githubgithub.com/bughuntar/CVE-2024-4577★ 0githubgithub.com/Didarul342/CVE-2024-4577★ 0githubgithub.com/mananjain61/PHP-CGI-INTERNAL-RCE★ 0githubgithub.com/Skycritch/CVE-2024-4577★ 0githubgithub.com/InfoSec-DB/PHPCGIScanner★ 0githubgithub.com/a1ex-var1amov/ctf-cve-2024-4577★ 0githubgithub.com/BLACK-ARCHIVERS/CVE-2024-4577★ 0githubgithub.com/rayngnpc/CVE-2024-4577-rayng★ 0githubgithub.com/Kanak-CypherX/cve-2024-4577-lab★ 0githubgithub.com/khwajasaad267-coder/cve-2024-4577-lab★ 0githubgithub.com/Suleman-Elahi/php2shell-sentinel★ 0githubgithub.com/graphite-org/CVE-2024-4577★ 0githubgithub.com/Dejavu666/CVE-2024-4577★ 0githubgithub.com/gmh5225/CVE-2024-4577-PHP-RCE★ 0githubgithub.com/princew88/CVE-2024-4577★ 0githubgithub.com/lockbitblack-ai/CVE-2024-4577-new★ 0githubgithub.com/tntrock/CVE-2024-4577_PowerShell★ 0githubgithub.com/jakabakos/CVE-2024-4577-PHP-CGI-argument-injection-RCE★ 0githubgithub.com/AhmedMansour93/Event-ID-268-Rule-Name-SOC292-Possible-PHP-Injection-Detected-CVE-2024-4577-★ 0githubgithub.com/yeee3642/edu-recon★ 0vulncheckvulncheck.com/xdb/5d24a3878ae0no verificadovulncheckvulncheck.com/xdb/b2fa764f2781no verificadovulncheckvulncheck.com/xdb/aed5b2a31554no verificadovulncheckvulncheck.com/xdb/c8e637167f42no verificadovulncheckvulncheck.com/xdb/975f3d4508fdno verificadovulncheckvulncheck.com/xdb/c3ffd6462c70no verificadovulncheckvulncheck.com/xdb/218b19f4d22eno verificadovulncheckvulncheck.com/xdb/ed23c8ab0f6ano verificadovulncheckvulncheck.com/xdb/d06e30d57aafno verificadovulncheckvulncheck.com/xdb/c4c00e052574no verificadovulncheckvulncheck.com/xdb/081170ce66e7no verificadovulncheckvulncheck.com/xdb/c8c379f83d10no verificadovulncheckvulncheck.com/xdb/64f14f4beecbno verificadovulncheckvulncheck.com/xdb/cb830f9d202fno verificadovulncheckvulncheck.com/xdb/d982c4edc474no verificadovulncheckvulncheck.com/xdb/0b2ec7cacbadno verificadovulncheckvulncheck.com/xdb/ff0f9bccbf68no verificadovulncheckvulncheck.com/xdb/a53150e5fe7bno verificadovulncheckvulncheck.com/xdb/3e8fa83c20c9no verificadovulncheckvulncheck.com/xdb/20d85040c310no verificadovulncheckvulncheck.com/xdb/825b99bdb560no verificadovulncheckvulncheck.com/xdb/56c6c80d0bc4no verificadovulncheckvulncheck.com/xdb/bd76b0f41ae3no verificadovulncheckvulncheck.com/xdb/e294281b4747no verificadovulncheckvulncheck.com/xdb/64046c52ba42no verificadovulncheckvulncheck.com/xdb/4f6effc389cdno verificadovulncheckvulncheck.com/xdb/5a6770491004no verificadovulncheckvulncheck.com/xdb/30f842b7c8c9no verificadovulncheckvulncheck.com/xdb/1531cf762de4no verificadovulncheckvulncheck.com/xdb/b914f202bec2no verificadovulncheckvulncheck.com/xdb/024996c990ccno verificadovulncheckvulncheck.com/xdb/48d0c04eff37no verificadovulncheckvulncheck.com/xdb/94a35549d41eno verificadovulncheckvulncheck.com/xdb/112f55c12274no verificadovulncheckvulncheck.com/xdb/55023f1ef157no verificadovulncheckvulncheck.com/xdb/bd5de034d60fno verificadovulncheckvulncheck.com/xdb/24731ac505a6no verificadovulncheckvulncheck.com/xdb/fb1b068d71fbno verificadovulncheckvulncheck.com/xdb/615662ae6addno verificadovulncheckvulncheck.com/xdb/b4cc52bca529no verificadovulncheckvulncheck.com/xdb/1b1ee9a9f8a3no verificadovulncheckvulncheck.com/xdb/c81a2db7a37cno verificadovulncheckvulncheck.com/xdb/148c9b11e6f8no verificadovulncheckvulncheck.com/xdb/c24045f1f2b0no verificadovulncheckvulncheck.com/xdb/3e908cfb9d26no verificadovulncheckvulncheck.com/xdb/11c7d322fe03no verificadovulncheckvulncheck.com/xdb/fa348e621ba5no verificadovulncheckvulncheck.com/xdb/d943b0b2089bno verificadovulncheckvulncheck.com/xdb/4b9a71f3a5cfno verificadovulncheckvulncheck.com/xdb/eeb081100dd5no verificadovulncheckvulncheck.com/xdb/552c4106ae73no verificadovulncheckvulncheck.com/xdb/d89b163c7ba9no verificadovulncheckvulncheck.com/xdb/912529ac004fno verificadovulncheckvulncheck.com/xdb/cb77704fc152no verificadovulncheckvulncheck.com/xdb/293eaa222a74no verificadovulncheckvulncheck.com/xdb/9e5daca09c8cno verificadovulncheckvulncheck.com/xdb/0c4b91081cb3no verificadovulncheckvulncheck.com/xdb/7ee6ed2bc73fno verificadovulncheckvulncheck.com/xdb/5d63cc33def4no verificadovulncheckvulncheck.com/xdb/7d0a6bcc1e48no verificadovulncheckvulncheck.com/xdb/b72a24a02e12no verificadovulncheckvulncheck.com/xdb/7c4a4d3d9cedno verificadovulncheckvulncheck.com/xdb/b2eb4bae1e05no verificadovulncheckvulncheck.com/xdb/d3b12b49d03cno verificadovulncheckvulncheck.com/xdb/7dd0ca311187no verificadovulncheckvulncheck.com/xdb/aa3899b675a4no verificadovulncheckvulncheck.com/xdb/cd32f509d4abno verificadovulncheckvulncheck.com/xdb/1287f9a713c6no verificadovulncheckvulncheck.com/xdb/acfef3dab7abno verificadovulncheckvulncheck.com/xdb/cc11323372a3no verificadovulncheckvulncheck.com/xdb/7a69cea7f16dno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — PHP
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-109619CRITICALRCE via stale global stateEPSS 100.0%KEVCVE-2026-109618CRITICALRCE via OOM corruptionEPSS 100.0%KEVCVE-2022-31626HIGHmysqlnd/pdo password buffer overflowEPSS 58.1%CVE-2022-31629MEDIUM$_COOKIE names string replacement (. -> _): cookie integrity vulnerabilitiesEPSS 49.6%CVE-2024-2756MEDIUM__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fixEPSS 38.1%CVE-2024-1874CRITICALCommand injection via array-ish $command parameter of proc_open()EPSS 32.8%
Referencias
https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.htmlhttps://blog.talosintelligence.com/new-persistent-attacks-japan/https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediatelyhttps://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/https://github.com/11whoami99/CVE-2024-4577https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jvhttps://github.com/rapid7/metasploit-framework/pull/19247https://github.com/watchtowrlabs/CVE-2024-4577https://github.com/xcanwin/CVE-2024-4577-PHP-RCEhttps://isc.sans.edu/diary/30994https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/