关联漏洞
标题：
PHP 操作系统命令注入漏洞
(CVE-2024-4577)
描述：PHP是一种在服务器端执行的脚本语言。 PHP存在操作系统命令注入漏洞，该漏洞源于在特定条件下，Windows系统使用“Best-Fit”行为替换命令行中的字符，这可能导致PHP CGI模块错误地将这些字符解释为PHP选项，从而泄露脚本的源代码，在服务器上运行任意PHP代码等。以下版本受到影响：8.1至8.1.29之前版本，8.3至8.3.8之前版本，8.2至8.2.20之前版本。
描述
PHP CGI Argument Injection (CVE-2024-4577) Remote Code Execution PoC
介绍
# CVE-2024-4577
A Proof of Concept developed by [@watchTowr](https://twitter.com/watchtowrcyber) exploiting the PHP CGI Argument Injection vulnerability (CVE-2024-4577) to obtain RCE on a vulnerable PHP version running in a Windows environment. [Detailed technical analysis for this vulnerability](https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/)
<p align="center">
<img src="/poc.gif" />
</p>
# Orange Tsi 🍊
This vulnerability was found by [Orange Tsai (@orange_8361)](https://x.com/orange_8361) of [DEVCORE (@d3vc0r3)](https://x.com/d3vc0r3). Make sure to follow his outstanding research, our role was to only recreate and develop the exploit for this issue.
# Affected Versions
based on the original [blog post by DEVCORE (@d3vc0r3)](https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/) This vulnerability affects all versions of PHP installed on the Windows operating system:
```
PHP 8.3 < 8.3.8
PHP 8.2 < 8.2.20
PHP 8.1 < 8.1.29
```
Since the branch of PHP 8.0, PHP 7, and PHP 5 are End-of-Life, and are no longer maintained anymore, server admins can refer to the Am I Vulnerable section [HERE](https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/) to find temporary patch recommendations in the Mitigation Measure section.
# Exploit authors
[Aliz (@AlizTheHax0r)](https://x.com/AlizTheHax0r) and [Sina Kheirkhah (@SinSinology)](https://x.com/SinSinology) of [watchTowr (@watchtowrcyber)](https://twitter.com/watchtowrcyber)
# Follow [watchTowr](https://watchTowr.com) Labs
For the latest security research follow the [watchTowr](https://watchTowr.com) Labs Team
- https://labs.watchtowr.com/
- https://twitter.com/watchtowrcyber
- https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
- https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html
- https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/
文件快照
[4.0K] /data/pocs/4388bbbea27a4e4f7e07d88078b0546a6e0f35d7
├── [286K] poc.gif
├── [2.0K] README.md
└── [2.0K] watchTowr-vs-php_cve-2024-4577.py
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。