CVE detail
CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability
Source: CISA Known Exploited Vulnerabilities catalog · back to feed
Vendor / product
PHP Group · PHP
- Date added (KEV)
- Jun 12, 2024
- CISA due date
- Jul 03, 2024
- Ransomware campaign use
- Known
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor fix: Vendor patch
Scorifya interpretation
AI-generatedA short, structured read of the record above, generated when this page first loads, then cached for a week.
Plain English
Technical detail
From CISA
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.
This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://www.php.net/ChangeLog-8.php#; https://nvd.nist.gov/vuln/detail/CVE-2024-4577
See what attackers can see on your domain
This vulnerability is on CISA's Known Exploited Vulnerabilities list, so it is being exploited in the wild right now, including in ransomware campaigns. Scorifya can't test for PHP Group directly, but in about 30 seconds it shows what your own domain exposes publicly across TLS, security headers, DNS, and cookies: the surface attackers probe first.
SOC 2 compliance
Tracking remediation across your cloud infrastructure?
Scorifya Controls automates 54 SOC 2 checks across AWS, GitHub, GCP, and Azure, and gives you a manual evidence trail for the controls no tool can automate. Self-hosted, three tiers from $149/mo.
See Scorifya Controls →References
- https://github.com/rapid7/metasploit-framework/pull/19247ExploitIssue TrackingPatch
- https://github.com/rapid7/metasploit-framework/pull/19247ExploitIssue TrackingPatch
- http://www.openwall.com/lists/oss-security/2024/06/07/1Mailing ListThird Party Advisory
- https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/ExploitPress/Media CoverageThird Party Advisory
- https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.htmlThird Party Advisory
- https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediatelyThird Party Advisory
- https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/ExploitThird Party Advisory
- https://github.com/11whoami99/CVE-2024-4577Exploit
- https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jvExploitThird Party Advisory
- https://github.com/watchtowrlabs/CVE-2024-4577ExploitThird Party Advisory
- https://github.com/xcanwin/CVE-2024-4577-PHP-RCEExploitThird Party Advisory
- https://isc.sans.edu/diary/30994ExploitThird Party Advisory
- https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/ExploitThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/Mailing List
- https://security.netapp.com/advisory/ntap-20240621-0008/Third Party Advisory
- https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/Third Party Advisory
- https://www.php.net/ChangeLog-8.php#8.1.29Release Notes
- https://www.php.net/ChangeLog-8.php#8.2.20Release Notes
- https://www.php.net/ChangeLog-8.php#8.3.8Release Notes
- http://www.openwall.com/lists/oss-security/2024/06/07/1Mailing ListThird Party Advisory
- https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/ExploitPress/Media CoverageThird Party Advisory
- https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.htmlThird Party Advisory
- https://blog.talosintelligence.com/new-persistent-attacks-japan/ExploitThird Party Advisory
- https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediatelyThird Party Advisory
- https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/ExploitThird Party Advisory
- https://github.com/11whoami99/CVE-2024-4577Exploit
- https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jvExploitThird Party Advisory
- https://github.com/watchtowrlabs/CVE-2024-4577ExploitThird Party Advisory
- https://github.com/xcanwin/CVE-2024-4577-PHP-RCEExploitThird Party Advisory
- https://isc.sans.edu/diary/30994ExploitThird Party Advisory
- https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/ExploitThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/Mailing List
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/Mailing List
- https://security.netapp.com/advisory/ntap-20240621-0008/Third Party Advisory
- https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/Third Party Advisory
- https://www.php.net/ChangeLog-8.php#8.1.29Release Notes
- https://www.php.net/ChangeLog-8.php#8.2.20Release Notes
- https://www.php.net/ChangeLog-8.php#8.3.8Release Notes
- https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577ExploitThird Party Advisory
- https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577US Government Resource
Other recent CVEs from PHP Group
- CVE-2026-109618PHP, PHP Memory Corruption Vulnerability
- CVE-2026-109619PHP, PHP Stale Internal Request-State Vulnerability