New PHP Vulnerability Exposes Windows Servers to Remote Code Execution

Information have emerged about a new critical security flaw impacting PHP that could be exploited to obtain distant code execution under specific instances.

The vulnerability, tracked as CVE-2024-4577, has been explained as a CGI argument injection vulnerability influencing all variations of PHP installed on the Windows running program.

In accordance to DEVCORE security researcher, the shortcoming would make it probable to bypass protections place in place for a further security flaw, CVE-2012-1823.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“Though employing PHP, the crew did not recognize the Finest-Match characteristic of encoding conversion inside the Windows operating process,” security researcher Orange Tsai reported.

“This oversight enables unauthenticated attackers to bypass the preceding safety of CVE-2012-1823 by precise character sequences. Arbitrary code can be executed on distant PHP servers by the argument injection attack.”

Subsequent liable disclosure on May possibly 7, 2024, a resolve for the vulnerability has been produced available in PHP variations 8.3.8, 8.2.20, and 8.1.29.

DEVCORE has warned that all XAMPP installations on Windows are vulnerable by default when configured to use the locales for Common Chinese, Simplified Chinese, or Japanese.

The Taiwanese organization is also recommending that directors go absent from the outdated PHP CGI entirely and opt for a extra secure option these as Mod-PHP, FastCGI, or PHP-FPM.

“This vulnerability is extremely simple, but that’s also what can make it fascinating,” Tsai mentioned. “Who would have believed that a patch, which has been reviewed and demonstrated safe for the earlier 12 a long time, could be bypassed because of to a minimal Windows element?”

The Shadowserver Basis, in a post shared on X, mentioned it has presently detected exploitation tries involving the flaw against its honeypot servers in just 24 hours of public disclosure.

watchTowr Labs stated it was in a position to devise an exploit for CVE-2024-4577 and achieve remote code execution, producing it crucial that consumers go quickly to apply the most current patches.

“A awful bug with a incredibly very simple exploit,” security researcher Aliz Hammond explained.

“People working in an affected configuration beneath a single of the impacted locales – Chinese (simplified, or classic) or Japanese – are urged to do this as quick as humanly doable, as the bug has a significant likelihood of getting exploited en-mass owing to the low exploit complexity.”

Observed this post fascinating? Observe us on Twitter  and LinkedIn to browse much more exceptional content material we article.