CVE-2024-4577

9.8 CRITICAL CISA KEV - Actively Exploited
Published: June 09, 2024 Modified: November 03, 2025
View on NVD

Description

In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/06/07/1
Source: security@php.net
Mailing List Third Party Advisory
https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/
Source: security@php.net
Exploit Press/Media Coverage Third Party Advisory
https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html
Source: security@php.net
Third Party Advisory
https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately
Source: security@php.net
Third Party Advisory
https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
Source: security@php.net
Exploit Third Party Advisory
https://github.com/11whoami99/CVE-2024-4577
Source: security@php.net
Exploit
https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv
Source: security@php.net
Exploit Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/19247
Source: security@php.net
Exploit Issue Tracking Patch
https://github.com/watchtowrlabs/CVE-2024-4577
Source: security@php.net
Exploit Third Party Advisory
https://github.com/xcanwin/CVE-2024-4577-PHP-RCE
Source: security@php.net
Exploit Third Party Advisory
https://isc.sans.edu/diary/30994
Source: security@php.net
Exploit Third Party Advisory
https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/
Source: security@php.net
Exploit Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
Source: security@php.net
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
Source: security@php.net
Mailing List
https://security.netapp.com/advisory/ntap-20240621-0008/
Source: security@php.net
Third Party Advisory
https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/
Source: security@php.net
Third Party Advisory
https://www.php.net/ChangeLog-8.php#8.1.29
Source: security@php.net
Release Notes
https://www.php.net/ChangeLog-8.php#8.2.20
Source: security@php.net
Release Notes
https://www.php.net/ChangeLog-8.php#8.3.8
Source: security@php.net
Release Notes
http://www.openwall.com/lists/oss-security/2024/06/07/1
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List Third Party Advisory
https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Press/Media Coverage Third Party Advisory
https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://blog.talosintelligence.com/new-persistent-attacks-japan/
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory
https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory
https://github.com/11whoami99/CVE-2024-4577
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory
https://github.com/rapid7/metasploit-framework/pull/19247
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Issue Tracking Patch
https://github.com/watchtowrlabs/CVE-2024-4577
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory
https://github.com/xcanwin/CVE-2024-4577-PHP-RCE
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory
https://isc.sans.edu/diary/30994
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory
https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
https://security.netapp.com/advisory/ntap-20240621-0008/
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
https://www.php.net/ChangeLog-8.php#8.1.29
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
https://www.php.net/ChangeLog-8.php#8.2.20
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
https://www.php.net/ChangeLog-8.php#8.3.8
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory
https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

42 reference(s) from NVD

Quick Stats

CVSS v3 Score
9.8 / 10.0
EPSS (Exploit Probability)
94.4%
100th percentile
Exploitation Status
Actively Exploited
Remediation due: 2024-07-03

Weaknesses (CWE)

CWE-78 CWE-78

Affected Vendors

php fedoraproject microsoft

Related CVEs

CVE-2025-52691 10.0
CVE-2025-15168 7.3
CVE-2025-15167 7.3
CVE-2025-15166 7.3
CVE-2025-15165 7.3