⚠️ CISA Known Exploited Vulnerability
Active ThreatThis vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Active exploitation has been observed in the wild. This poses significant risk to federal enterprises and should be prioritized for immediate patching.
CVE-2024-4577
Critical CISA KEV
Low
Medium
High
Critical
9.8
CVSS Score
Vulnerability Description
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
N
Attack Complexity
L
Privileges Required
N
User Interaction
N
Scope
U
Confidentiality
H
Integrity
H
Availability
H
Known Affected Software
58 configuration(s) from 2 vendor(s)
fedora
Version:
40
CPE:
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
fedora
Version:
39
CPE:
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
php
Version:
8.3.5
CPE:
cpe:2.3:a:php:php:8.3.5:-:*:*:*:*:*:*
php
Version:
8.1.25
CPE:
cpe:2.3:a:php:php:8.1.25:-:*:*:*:*:*:*
php
Version:
8.2.0
CPE:
cpe:2.3:a:php:php:8.2.0:-:*:*:*:*:*:*
php
Version:
8.1.12
CPE:
cpe:2.3:a:php:php:8.1.12:*:*:*:*:*:*:*
php
Version:
8.1.27
CPE:
cpe:2.3:a:php:php:8.1.27:-:*:*:*:*:*:*
php
Version:
8.2.5
CPE:
cpe:2.3:a:php:php:8.2.5:-:*:*:*:*:*:*
php
Version:
8.1.5
CPE:
cpe:2.3:a:php:php:8.1.5:rc1:*:*:*:*:*:*
php
Version:
8.2.14
CPE:
cpe:2.3:a:php:php:8.2.14:-:*:*:*:*:*:*
php
Version:
8.2.13
CPE:
cpe:2.3:a:php:php:8.2.13:-:*:*:*:*:*:*
php
Version:
8.1.21
CPE:
cpe:2.3:a:php:php:8.1.21:-:*:*:*:*:*:*
php
Version:
8.2.9
CPE:
cpe:2.3:a:php:php:8.2.9:-:*:*:*:*:*:*
php
Version:
8.1.23
CPE:
cpe:2.3:a:php:php:8.1.23:-:*:*:*:*:*:*
php
Version:
8.2.19
CPE:
cpe:2.3:a:php:php:8.2.19:-:*:*:*:*:*:*
php
Version:
8.3.0
CPE:
cpe:2.3:a:php:php:8.3.0:-:*:*:*:*:*:*
php
Version:
8.3.6
CPE:
cpe:2.3:a:php:php:8.3.6:-:*:*:*:*:*:*
php
Version:
8.3.1
CPE:
cpe:2.3:a:php:php:8.3.1:-:*:*:*:*:*:*
php
Version:
8.2.1
CPE:
cpe:2.3:a:php:php:8.2.1:-:*:*:*:*:*:*
php
Version:
8.1.7
CPE:
cpe:2.3:a:php:php:8.1.7:rc1:*:*:*:*:*:*
php
Version:
8.3.7
CPE:
cpe:2.3:a:php:php:8.3.7:-:*:*:*:*:*:*
php
Version:
8.1.1
CPE:
cpe:2.3:a:php:php:8.1.1:rc1:*:*:*:*:*:*
php
Version:
8.1.28
CPE:
cpe:2.3:a:php:php:8.1.28:-:*:*:*:*:*:*
php
Version:
8.1.15
CPE:
cpe:2.3:a:php:php:8.1.15:*:*:*:*:*:*:*
php
Version:
8.2.16
CPE:
cpe:2.3:a:php:php:8.2.16:-:*:*:*:*:*:*
php
Version:
8.1.4
CPE:
cpe:2.3:a:php:php:8.1.4:rc1:*:*:*:*:*:*
php
Version:
8.2.18
CPE:
cpe:2.3:a:php:php:8.2.18:-:*:*:*:*:*:*
php
Version:
8.2.10
CPE:
cpe:2.3:a:php:php:8.2.10:-:*:*:*:*:*:*
php
Version:
8.1.14
CPE:
cpe:2.3:a:php:php:8.1.14:*:*:*:*:*:*:*
php
Version:
8.2.11
CPE:
cpe:2.3:a:php:php:8.2.11:-:*:*:*:*:*:*
php
Version:
8.1.22
CPE:
cpe:2.3:a:php:php:8.1.22:rc1:*:*:*:*:*:*
php
Version:
8.1.17
CPE:
cpe:2.3:a:php:php:8.1.17:-:*:*:*:*:*:*
php
Version:
8.1.10
CPE:
cpe:2.3:a:php:php:8.1.10:*:*:*:*:*:*:*
php
Version:
8.2.2
CPE:
cpe:2.3:a:php:php:8.2.2:-:*:*:*:*:*:*
php
Version:
8.1.8
CPE:
cpe:2.3:a:php:php:8.1.8:*:*:*:*:*:*:*
php
Version:
8.2.17
CPE:
cpe:2.3:a:php:php:8.2.17:-:*:*:*:*:*:*
php
Version:
8.1.3
CPE:
cpe:2.3:a:php:php:8.1.3:rc1:*:*:*:*:*:*
php
Version:
8.1.13
CPE:
cpe:2.3:a:php:php:8.1.13:*:*:*:*:*:*:*
php
Version:
8.1.9
CPE:
cpe:2.3:a:php:php:8.1.9:*:*:*:*:*:*:*
php
Version:
8.1.0
CPE:
cpe:2.3:a:php:php:8.1.0:rc4:*:*:*:*:*:*
php
Version:
8.2.12
CPE:
cpe:2.3:a:php:php:8.2.12:-:*:*:*:*:*:*
php
Version:
8.2.7
CPE:
cpe:2.3:a:php:php:8.2.7:-:*:*:*:*:*:*
php
Version:
8.1.6
CPE:
cpe:2.3:a:php:php:8.1.6:rc1:*:*:*:*:*:*
php
Version:
8.2.3
CPE:
cpe:2.3:a:php:php:8.2.3:*:*:*:*:*:*:*
php
Version:
8.1.18
CPE:
cpe:2.3:a:php:php:8.1.18:-:*:*:*:*:*:*
php
Version:
8.2.4
CPE:
cpe:2.3:a:php:php:8.2.4:-:*:*:*:*:*:*
php
Version:
8.1.16
CPE:
cpe:2.3:a:php:php:8.1.16:*:*:*:*:*:*:*
php
Version:
8.3.2
CPE:
cpe:2.3:a:php:php:8.3.2:-:*:*:*:*:*:*
php
Version:
8.3.3
CPE:
cpe:2.3:a:php:php:8.3.3:-:*:*:*:*:*:*
php
Version:
8.1.2
CPE:
cpe:2.3:a:php:php:8.1.2:rc1:*:*:*:*:*:*
php
Version:
8.3.4
CPE:
cpe:2.3:a:php:php:8.3.4:-:*:*:*:*:*:*
php
Version:
8.1.24
CPE:
cpe:2.3:a:php:php:8.1.24:-:*:*:*:*:*:*
php
Version:
8.1.20
CPE:
cpe:2.3:a:php:php:8.1.20:-:*:*:*:*:*:*
php
Version:
8.2.6
CPE:
cpe:2.3:a:php:php:8.2.6:-:*:*:*:*:*:*
php
Version:
8.1.26
CPE:
cpe:2.3:a:php:php:8.1.26:-:*:*:*:*:*:*
php
Version:
8.2.8
CPE:
cpe:2.3:a:php:php:8.2.8:-:*:*:*:*:*:*
php
Version:
8.1.19
CPE:
cpe:2.3:a:php:php:8.1.19:-:*:*:*:*:*:*
php
Version:
8.2.15
CPE:
cpe:2.3:a:php:php:8.2.15:-:*:*:*:*:*:*
This vulnerability affects 58 software configuration(s). Ensure you patch all affected systems.
Microsoft
2024-Jun-CVE-2024-4577
CVE-2024-4577: Argument Injection in PHP-CGI
Severity
Unknown
Released
Oct 22, 2025
Security Update
Microsoft
2024-Oct-CVE-2024-8926
CVE-2024-8926: PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)
Severity
Unknown
Released
Oct 01, 2025
Security Update
References & Resources
-
http://www.openwall.com/lists/oss-security/2024/06/07/1security@php.net Mailing List Third Party Advisory
-
https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/security@php.net Exploit Press/Media Coverage Third Party Advisory
-
https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.htmlsecurity@php.net Third Party Advisory
-
https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediatelysecurity@php.net Third Party Advisory
-
https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/security@php.net Exploit Third Party Advisory
-
https://github.com/11whoami99/CVE-2024-4577security@php.net Exploit
-
https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jvsecurity@php.net Exploit Third Party Advisory
-
https://github.com/rapid7/metasploit-framework/pull/19247security@php.net Exploit Issue Tracking Patch
-
https://github.com/watchtowrlabs/CVE-2024-4577security@php.net Exploit Third Party Advisory
-
https://github.com/xcanwin/CVE-2024-4577-PHP-RCEsecurity@php.net Exploit Third Party Advisory
-
https://isc.sans.edu/diary/30994security@php.net Exploit Third Party Advisory
-
https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/security@php.net Exploit Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/security@php.net Mailing List
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/security@php.net Mailing List
-
https://security.netapp.com/advisory/ntap-20240621-0008/security@php.net Third Party Advisory
-
https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/security@php.net Third Party Advisory
-
https://www.php.net/ChangeLog-8.php#8.1.29security@php.net Release Notes
-
https://www.php.net/ChangeLog-8.php#8.2.20security@php.net Release Notes
-
https://www.php.net/ChangeLog-8.php#8.3.8security@php.net Release Notes
-
http://www.openwall.com/lists/oss-security/2024/06/07/1af854a3a-2127-422b-91ae-364da2661108 Mailing List Third Party Advisory
-
https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/af854a3a-2127-422b-91ae-364da2661108 Exploit Press/Media Coverage Third Party Advisory
-
https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.htmlaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://blog.talosintelligence.com/new-persistent-attacks-japan/af854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
-
https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediatelyaf854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/af854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
-
https://github.com/11whoami99/CVE-2024-4577af854a3a-2127-422b-91ae-364da2661108 Exploit
-
https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jvaf854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
-
https://github.com/rapid7/metasploit-framework/pull/19247af854a3a-2127-422b-91ae-364da2661108 Exploit Issue Tracking Patch
-
https://github.com/watchtowrlabs/CVE-2024-4577af854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
-
https://github.com/xcanwin/CVE-2024-4577-PHP-RCEaf854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
-
https://isc.sans.edu/diary/30994af854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
-
https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/af854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/af854a3a-2127-422b-91ae-364da2661108 Mailing List
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/af854a3a-2127-422b-91ae-364da2661108 Mailing List
-
https://security.netapp.com/advisory/ntap-20240621-0008/af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/af854a3a-2127-422b-91ae-364da2661108 Third Party Advisory
-
https://www.php.net/ChangeLog-8.php#8.1.29af854a3a-2127-422b-91ae-364da2661108 Release Notes
-
https://www.php.net/ChangeLog-8.php#8.2.20af854a3a-2127-422b-91ae-364da2661108 Release Notes
-
https://www.php.net/ChangeLog-8.php#8.3.8af854a3a-2127-422b-91ae-364da2661108 Release Notes
-
https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577af854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
-
https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577af854a3a-2127-422b-91ae-364da2661108 Exploit Third Party Advisory
-
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577134c704f-9b21-4f2e-91b3-4a467353bcc0 US Government Resource
Severity Details
9.8
out of 10.0
Critical
CISA KEV Status
Active Exploitation
Listed in CISA's Known Exploited Vulnerabilities catalog
Weakness Type (CWE)
CWE-78
Top 25 #13
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Description
- The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a…
- Exploit Likelihood
- High
- Typical Severity
- High
- OWASP Top 10
- A03:2021-Injection
- Abstraction Level
- Base
Key Information
- Published Date
- June 09, 2024
