Particulars have emerged a few new vital safety flaw impacting PHP that may very well be exploited to attain distant code execution beneath sure circumstances.
The vulnerability, tracked as CVE-2024-4577, has been described as a CGI argument injection vulnerability affecting all variations of PHP put in on the Home windows working system.
In response to DEVCORE safety researcher, the shortcoming makes it potential to bypass protections put in place for one more safety flaw, CVE-2012-1823.
“Whereas implementing PHP, the group didn’t discover the Finest-Match function of encoding conversion throughout the Home windows working system,” safety researcher Orange Tsai stated.
“This oversight allows unauthenticated attackers to bypass the previous protection of CVE-2012-1823 by specific character sequences. Arbitrary code can be executed on remote PHP servers through the argument injection attack.”
Following accountable disclosure on Might 7, 2024, a repair for the vulnerability has been made accessible in PHP variations 8.3.8, 8.2.20, and eight.1.29.
DEVCORE has warned that each one XAMPP installations on Home windows are weak by default when configured to make use of the locales for Conventional Chinese language, Simplified Chinese language, or Japanese.
The Taiwanese firm can also be recommending that directors transfer away from the outdated PHP CGI altogether and go for a safer resolution akin to Mod-PHP, FastCGI, or PHP-FPM.
“This vulnerability is incredibly simple, but that’s also what makes it interesting,” Tsai stated. “Who would have thought that a patch, which has been reviewed and proven secure for the past 12 years, could be bypassed due to a minor Windows feature?”
The Shadowserver Basis, in a publish shared on X, stated it has already detected exploitation makes an attempt involving the flaw towards its honeypot servers inside 24 hours of public disclosure.
watchTowr Labs stated it was capable of devise an exploit for CVE-2024-4577 and obtain distant code execution, making it crucial that customers transfer rapidly to use the most recent patches.
“A nasty bug with a very simple exploit,” safety researcher Aliz Hammond stated.
“Those running in an affected configuration under one of the affected locales – Chinese (simplified, or traditional) or Japanese – are urged to do this as fast as humanly possible, as the bug has a high chance of being exploited en-mass due to the low exploit complexity.”
