CVE-2024-4577 PoC — PHP 操作系统命令注入漏洞

Description

Proof Of Concept RCE exploit for critical vulnerability in PHP <8.2.15 (Windows), allowing attackers to execute arbitrary commands.

介绍

# CVE-2024-4577: Critical Vulnerability in PHP's CGI Configurations

A severe security flaw exists in PHP's CGI mode that allows attackers to run arbitrary commands by manipulating URL parameters.

### Impacted Versions

- PHP versions before 7.4.29 and 8.0.19 on Windows running php-cgi.

### Attack Methodology

- Attackers can leverage this vulnerability by sending specially crafted requests to the PHP CGI script. These requests inject malicious parameters, enabling the execution of arbitrary commands. This can potentially result in complete system compromise.

## Usage Instructions

### Prerequisites

Before running the script, ensure you have Python 3 installed on your system. Additionally, you need the `requests` library for handling HTTP requests.

### Installing Dependencies

You can install the required dependencies using `pip`. If `pip` is not installed, follow the instructions [here](https://pip.pypa.io/en/stable/installation/).

1. Open your terminal or command prompt.
2. Run the following command to install the `requests` library:

```sh
pip install requests
```

### Running the Script

To check a target URL for the CVE-2024-4577 vulnerability, follow these steps:

- Execute the script using python3 with the target URL as an argument.

```sh
python3 exploit.py <target>
```

For instance, to test the URL http://example.com, run:

```sh
python3 exploit.py http://example.com
```

### Script Output

The script will test the provided target URL for the vulnerability and print the results to the console. It will indicate whether a potential vulnerability was found or if no vulnerability was detected.

```
(+) Potential vulnerability found at: http://example.com/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
(-) No vulnerability found at: http://example.com/php-cgi/php-cgi.exe?%ADd+allow_url_include
```

### Remediation Steps

1. Update PHP to the latest version.
2. Ensure input parameters are properly sanitized and validated.
3. Apply secure configuration settings to restrict CGI parameter processing.

## Credits

This vulnerability was found by Orange Tsai (@orange_8361)

文件快照

备注