CVE-2024-1874 (GCVE-0-2024-1874)

Vulnerability from cvelistv5 – Published: 2024-04-29 03:57 – Updated: 2025-11-04 18:22

Title

Command injection via array-ish $command parameter of proc_open()

Summary

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Severity ?

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE

CWE-116 - Improper Encoding or Escaping of Output

Assigner

php

References

6 references

URL	Tags
https://github.com/php/php-src/security/advisorie…
http://www.openwall.com/lists/oss-security/2024/0…
https://security.netapp.com/advisory/ntap-2024051…
http://www.openwall.com/lists/oss-security/2024/06/07/1
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

1 product

Vendor	Product	Version
PHP Group	PHP	Affected: 8.1.* , < 8.1.28 (semver) Affected: 8.2.* , < 8.2.18 (semver) Affected: 8.3.* , < 8.3.5 (semver)

Date Public ?

2024-04-11 17:15

Credits

RyotaK

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:php_group:php:8.1.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "php",
            "vendor": "php_group",
            "versions": [
              {
                "status": "affected",
                "version": "8.1.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:php_group:php:8.2.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "php",
            "vendor": "php_group",
            "versions": [
              {
                "status": "affected",
                "version": "8.2.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:php_group:php:8.3.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "php",
            "vendor": "php_group",
            "versions": [
              {
                "status": "affected",
                "version": "8.3.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1874",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-29T13:05:18.510843Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:00:58.913Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T18:22:36.621Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
          },
          {
            "url": "https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"
          },
          {
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/"
          },
          {
            "url": "https://www.kb.cert.org/vuls/id/123335"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "Windows"
          ],
          "product": "PHP",
          "vendor": "PHP Group",
          "versions": [
            {
              "lessThan": "8.1.28",
              "status": "affected",
              "version": "8.1.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.2.18",
              "status": "affected",
              "version": "8.2.*",
              "versionType": "semver"
            },
            {
              "lessThan": "8.3.5",
              "status": "affected",
              "version": "8.3.*",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This problem only present in Windows versions of PHP.\u0026nbsp;"
            }
          ],
          "value": "This problem only present in Windows versions of PHP."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "RyotaK"
        }
      ],
      "datePublic": "2024-04-11T17:15:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-116",
              "description": "CWE-116 Improper Encoding or Escaping of Output",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-13T04:06:17.168Z",
        "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
        "shortName": "php"
      },
      "references": [
        {
          "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
        }
      ],
      "source": {
        "advisory": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254",
        "discovery": "EXTERNAL"
      },
      "title": "Command injection via array-ish $command parameter of proc_open()",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Using proc_open() string syntax avoids the problem.\u0026nbsp;"
            }
          ],
          "value": "Using proc_open() string syntax avoids the problem."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b",
    "assignerShortName": "php",
    "cveId": "CVE-2024-1874",
    "datePublished": "2024-04-29T03:57:35.624Z",
    "dateReserved": "2024-02-25T04:39:00.479Z",
    "dateUpdated": "2025-11-04T18:22:36.621Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-1874",
      "date": "2026-05-22",
      "epss": "0.68573",
      "percentile": "0.98638"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\\u00a0\\n\\n\"}, {\"lang\": \"es\", \"value\": \"En las versiones de PHP 8.1.* anteriores a 8.1.28, 8.2.* anteriores a 8.2.18, 8.3.* anteriores a 8.3.5, cuando se utiliza el comando proc_open() con sintaxis de matriz, debido a un escape insuficiente, si los argumentos del comando ejecutado son controlado por un usuario malintencionado, el usuario puede proporcionar argumentos que ejecutar\\u00edan comandos arbitrarios en el shell de Windows.\"}]",
      "id": "CVE-2024-1874",
      "lastModified": "2024-11-21T08:51:29.893",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security@php.net\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\", \"baseScore\": 9.4, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.5}]}",
      "published": "2024-04-29T04:15:07.580",
      "references": "[{\"url\": \"http://www.openwall.com/lists/oss-security/2024/04/12/11\", \"source\": \"security@php.net\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/06/07/1\", \"source\": \"security@php.net\"}, {\"url\": \"https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7\", \"source\": \"security@php.net\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/\", \"source\": \"security@php.net\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/\", \"source\": \"security@php.net\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240510-0009/\", \"source\": \"security@php.net\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/04/12/11\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/06/07/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240510-0009/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@php.net",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security@php.net\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-116\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-1874\",\"sourceIdentifier\":\"security@php.net\",\"published\":\"2024-04-29T04:15:07.580\",\"lastModified\":\"2025-11-04T19:16:27.900\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\"},{\"lang\":\"es\",\"value\":\"En las versiones de PHP 8.1.* anteriores a 8.1.28, 8.2.* anteriores a 8.2.18, 8.3.* anteriores a 8.3.5, cuando se utiliza el comando proc_open() con sintaxis de matriz, debido a un escape insuficiente, si los argumentos del comando ejecutado son controlado por un usuario malintencionado, el usuario puede proporcionar argumentos que ejecutar\u00edan comandos arbitrarios en el shell de Windows.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@php.net\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":5.5}]},\"weaknesses\":[{\"source\":\"security@php.net\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-116\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.1.0\",\"versionEndExcluding\":\"8.1.28\",\"matchCriteriaId\":\"A888D1BE-9D93-4707-AA45-61EF1DB5488C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.2.0\",\"versionEndExcluding\":\"8.2.18\",\"matchCriteriaId\":\"6AC1B000-D5C4-49E9-8EFE-8C5C8FF50AF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:php:php:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.3.0\",\"versionEndExcluding\":\"8.3.5\",\"matchCriteriaId\":\"BE619987-797E-493B-B089-2E1CADDA9C47\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA277A6C-83EC-4536-9125-97B84C4FAF59\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2024/04/12/11\",\"source\":\"security@php.net\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/06/07/1\",\"source\":\"security@php.net\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7\",\"source\":\"security@php.net\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/\",\"source\":\"security@php.net\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/\",\"source\":\"security@php.net\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20240510-0009/\",\"source\":\"security@php.net\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/04/12/11\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/06/07/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20240510-0009/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.kb.cert.org/vuls/id/123335\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/04/12/11\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240510-0009/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/06/07/1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-04T17:14:11.693Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-1874\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-29T13:05:18.510843Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:php_group:php:8.1.0:*:*:*:*:*:*:*\"], \"vendor\": \"php_group\", \"product\": \"php\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.1.0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:php_group:php:8.2.0:*:*:*:*:*:*:*\"], \"vendor\": \"php_group\", \"product\": \"php\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.2.0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:php_group:php:8.3.0:*:*:*:*:*:*:*\"], \"vendor\": \"php_group\", \"product\": \"php\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.3.0\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-04-29T13:09:16.021Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"Command injection via array-ish $command parameter of proc_open()\", \"source\": {\"advisory\": \"https://github.com/php/php-src/security/advisories/GHSA-pc52-254\", \"discovery\": \"EXTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"RyotaK\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"PHP Group\", \"product\": \"PHP\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.1.*\", \"lessThan\": \"8.1.28\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.2.*\", \"lessThan\": \"8.2.18\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"8.3.*\", \"lessThan\": \"8.3.5\", \"versionType\": \"semver\"}], \"platforms\": [\"Windows\"], \"defaultStatus\": \"affected\"}], \"datePublic\": \"2024-04-11T17:15:00.000Z\", \"references\": [{\"url\": \"https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/04/12/11\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20240510-0009/\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/06/07/1\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/\"}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Using proc_open() string syntax avoids the problem.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Using proc_open() string syntax avoids the problem.\u0026nbsp;\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\u0026nbsp;\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-116\", \"description\": \"CWE-116 Improper Encoding or Escaping of Output\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"This problem only present in Windows versions of PHP.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"This problem only present in Windows versions of PHP.\u0026nbsp;\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"dd77f84a-d19a-4638-8c3d-a322d820ed2b\", \"shortName\": \"php\", \"dateUpdated\": \"2024-06-13T04:06:17.168Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-1874\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-04T17:14:11.693Z\", \"dateReserved\": \"2024-02-25T04:39:00.479Z\", \"assignerOrgId\": \"dd77f84a-d19a-4638-8c3d-a322d820ed2b\", \"datePublished\": \"2024-04-29T03:57:35.624Z\", \"assignerShortName\": \"php\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2024-AVI-0300

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, une exécution de code arbitraire et un déni de service.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
PHP	PHP	PHP versions 8.3.x antérieures à 8.3.6
PHP	PHP	PHP versions 8.2.x antérieures à 8.2.18
PHP	PHP	PHP versions 8.1.x antérieures à 8.1.28

References

Title

Publication Time

Tags

Bulletin de sécurité PHP 8.3.6 du 11 avril 2024	None	vendor-advisory
Bulletin de sécurité PHP 8.2.18 du 11 avril 2024	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "PHP versions 8.3.x ant\u00e9rieures \u00e0 8.3.6",
      "product": {
        "name": "PHP",
        "vendor": {
          "name": "PHP",
          "scada": false
        }
      }
    },
    {
      "description": "PHP versions 8.2.x ant\u00e9rieures \u00e0 8.2.18",
      "product": {
        "name": "PHP",
        "vendor": {
          "name": "PHP",
          "scada": false
        }
      }
    },
    {
      "description": "PHP versions 8.1.x ant\u00e9rieures \u00e0 8.1.28",
      "product": {
        "name": "PHP",
        "vendor": {
          "name": "PHP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-3096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3096"
    },
    {
      "name": "CVE-2024-2756",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-2756"
    },
    {
      "name": "CVE-2024-1874",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
    },
    {
      "name": "CVE-2024-2757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-2757"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0300",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-04-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans PHP. Certaines\nd\u0027entre elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de\ns\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code arbitraire et\nun d\u00e9ni de service.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans PHP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 PHP 8.3.6 du 11 avril 2024",
      "url": "https://www.php.net/ChangeLog-8.php#8.3.6"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 PHP 8.2.18 du 11 avril 2024",
      "url": "https://www.php.net/ChangeLog-8.php#8.2.18"
    }
  ]
}

CERTFR-2024-AVI-0475

Vulnerability from certfr_avis - Published: - Updated:

De multiples vulnérabilités ont été découvertes dans Tenable Security Center. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Tenable	Security Center	Security Center versions antérieures à 6.4.0

References

Title

Publication Time

Tags

Bulletin de sécurité Tenable tns-2024-10

2024-07-02

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Security Center versions ant\u00e9rieures \u00e0 6.4.0",
      "product": {
        "name": "Security Center",
        "vendor": {
          "name": "Tenable",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-24795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24795"
    },
    {
      "name": "CVE-2023-38709",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38709"
    },
    {
      "name": "CVE-2024-27316",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27316"
    },
    {
      "name": "CVE-2024-3096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3096"
    },
    {
      "name": "CVE-2024-1874",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
    },
    {
      "name": "CVE-2024-1891",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1891"
    },
    {
      "name": "CVE-2024-5759",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5759"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0475",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-06-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Tenable Security Center. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Tenable Security Center",
  "vendor_advisories": [
    {
      "published_at": "2024-07-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Tenable tns-2024-10",
      "url": "https://www.tenable.com/security/tns-2024-10"
    }
  ]
}

CERTFR-2024-AVI-0300

Vulnerability from certfr_avis - Published: - Updated:

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
PHP	PHP	PHP versions 8.3.x antérieures à 8.3.6
PHP	PHP	PHP versions 8.2.x antérieures à 8.2.18
PHP	PHP	PHP versions 8.1.x antérieures à 8.1.28

References

Title

Publication Time

Tags

Bulletin de sécurité PHP 8.3.6 du 11 avril 2024	None	vendor-advisory
Bulletin de sécurité PHP 8.2.18 du 11 avril 2024	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "PHP versions 8.3.x ant\u00e9rieures \u00e0 8.3.6",
      "product": {
        "name": "PHP",
        "vendor": {
          "name": "PHP",
          "scada": false
        }
      }
    },
    {
      "description": "PHP versions 8.2.x ant\u00e9rieures \u00e0 8.2.18",
      "product": {
        "name": "PHP",
        "vendor": {
          "name": "PHP",
          "scada": false
        }
      }
    },
    {
      "description": "PHP versions 8.1.x ant\u00e9rieures \u00e0 8.1.28",
      "product": {
        "name": "PHP",
        "vendor": {
          "name": "PHP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-3096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3096"
    },
    {
      "name": "CVE-2024-2756",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-2756"
    },
    {
      "name": "CVE-2024-1874",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
    },
    {
      "name": "CVE-2024-2757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-2757"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0300",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-04-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans PHP. Certaines\nd\u0027entre elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de\ns\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, une ex\u00e9cution de code arbitraire et\nun d\u00e9ni de service.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans PHP",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 PHP 8.3.6 du 11 avril 2024",
      "url": "https://www.php.net/ChangeLog-8.php#8.3.6"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 PHP 8.2.18 du 11 avril 2024",
      "url": "https://www.php.net/ChangeLog-8.php#8.2.18"
    }
  ]
}

CERTFR-2024-AVI-0475

Vulnerability from certfr_avis - Published: - Updated:

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Tenable	Security Center	Security Center versions antérieures à 6.4.0

References

Title

Publication Time

Tags

Bulletin de sécurité Tenable tns-2024-10

2024-07-02

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Security Center versions ant\u00e9rieures \u00e0 6.4.0",
      "product": {
        "name": "Security Center",
        "vendor": {
          "name": "Tenable",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-24795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-24795"
    },
    {
      "name": "CVE-2023-38709",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-38709"
    },
    {
      "name": "CVE-2024-27316",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-27316"
    },
    {
      "name": "CVE-2024-3096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-3096"
    },
    {
      "name": "CVE-2024-1874",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1874"
    },
    {
      "name": "CVE-2024-1891",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-1891"
    },
    {
      "name": "CVE-2024-5759",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-5759"
    }
  ],
  "links": [],
  "reference": "CERTFR-2024-AVI-0475",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-06-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    },
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Tenable Security Center. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Tenable Security Center",
  "vendor_advisories": [
    {
      "published_at": "2024-07-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Tenable tns-2024-10",
      "url": "https://www.tenable.com/security/tns-2024-10"
    }
  ]
}

bit-libphp-2024-1874

Vulnerability from bitnami_vulndb

Published

2025-08-11 13:54

Modified

2025-11-06 13:25

Summary

Command injection via array-ish $command parameter of proc_open()

Details

In PHP versions 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "libphp",
        "purl": "pkg:bitnami/libphp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.1.28"
            },
            {
              "introduced": "8.2.0"
            },
            {
              "fixed": "8.2.18"
            },
            {
              "introduced": "8.3.0"
            },
            {
              "fixed": "8.3.5"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-1874"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
    ],
    "severity": "Critical"
  },
  "details": "In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.",
  "id": "BIT-libphp-2024-1874",
  "modified": "2025-11-06T13:25:46.476Z",
  "published": "2025-08-11T13:54:08.513Z",
  "references": [
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1874"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/123335"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "Command injection via array-ish $command parameter of proc_open()"
}

bit-php-2024-1874

Vulnerability from bitnami_vulndb

Published

2024-05-14 07:29

Modified

2025-11-06 13:25

Summary

Command injection via array-ish $command parameter of proc_open()

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "php",
        "purl": "pkg:bitnami/php"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8.1.28"
            },
            {
              "introduced": "8.2.0"
            },
            {
              "fixed": "8.2.18"
            },
            {
              "introduced": "8.3.0"
            },
            {
              "fixed": "8.3.5"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-1874"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
    ],
    "severity": "Critical"
  },
  "details": "In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.",
  "id": "BIT-php-2024-1874",
  "modified": "2025-11-06T13:25:46.476Z",
  "published": "2024-05-14T07:29:52.385Z",
  "references": [
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
    },
    {
      "type": "WEB",
      "url": "https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1874"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"
    },
    {
      "type": "WEB",
      "url": "https://www.kb.cert.org/vuls/id/123335"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Command injection via array-ish $command parameter of proc_open()"
}

FKIE_CVE-2024-1874

Vulnerability from fkie_nvd - Published: 2024-04-29 04:15 - Updated: 2025-11-04 19:16

Severity ?

9.4 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Summary

References

URL	Tags
security@php.net	http://www.openwall.com/lists/oss-security/2024/04/12/11	Mailing List
security@php.net	http://www.openwall.com/lists/oss-security/2024/06/07/1	Mailing List
security@php.net	https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7	Exploit, Vendor Advisory
security@php.net	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/	Mailing List
security@php.net	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/	Mailing List
security@php.net	https://security.netapp.com/advisory/ntap-20240510-0009/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2024/04/12/11	Mailing List
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2024/06/07/1	Mailing List
af854a3a-2127-422b-91ae-364da2661108	https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7	Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/	Mailing List
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/	Mailing List
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/
af854a3a-2127-422b-91ae-364da2661108	https://security.netapp.com/advisory/ntap-20240510-0009/	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.kb.cert.org/vuls/id/123335
af854a3a-2127-422b-91ae-364da2661108	https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585	Exploit, Third Party Advisory

Impacted products

Vendor	Product	Version
php	php	*
php	php	*
php	php	*
fedoraproject	fedora	39
fedoraproject	fedora	40

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A888D1BE-9D93-4707-AA45-61EF1DB5488C",
              "versionEndExcluding": "8.1.28",
              "versionStartIncluding": "8.1.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6AC1B000-D5C4-49E9-8EFE-8C5C8FF50AF2",
              "versionEndExcluding": "8.2.18",
              "versionStartIncluding": "8.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE619987-797E-493B-B089-2E1CADDA9C47",
              "versionEndExcluding": "8.3.5",
              "versionStartIncluding": "8.3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8EDB836-4E6A-4B71-B9B2-AA3E03E0F646",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA277A6C-83EC-4536-9125-97B84C4FAF59",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell."
    },
    {
      "lang": "es",
      "value": "En las versiones de PHP 8.1.* anteriores a 8.1.28, 8.2.* anteriores a 8.2.18, 8.3.* anteriores a 8.3.5, cuando se utiliza el comando proc_open() con sintaxis de matriz, debido a un escape insuficiente, si los argumentos del comando ejecutado son controlado por un usuario malintencionado, el usuario puede proporcionar argumentos que ejecutar\u00edan comandos arbitrarios en el shell de Windows."
    }
  ],
  "id": "CVE-2024-1874",
  "lastModified": "2025-11-04T19:16:27.900",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 9.4,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.5,
        "source": "security@php.net",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-04-29T04:15:07.580",
  "references": [
    {
      "source": "security@php.net",
      "tags": [
        "Mailing List"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
    },
    {
      "source": "security@php.net",
      "tags": [
        "Mailing List"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
    },
    {
      "source": "security@php.net",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
    },
    {
      "source": "security@php.net",
      "tags": [
        "Mailing List"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
    },
    {
      "source": "security@php.net",
      "tags": [
        "Mailing List"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
    },
    {
      "source": "security@php.net",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2024/04/12/11"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List"
      ],
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://security.netapp.com/advisory/ntap-20240510-0009/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.kb.cert.org/vuls/id/123335"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585"
    }
  ],
  "sourceIdentifier": "security@php.net",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ],
      "source": "security@php.net",
      "type": "Secondary"
    }
  ]
}

GSD-2024-1874

Vulnerability from gsd - Updated: 2024-02-25 06:02

Details

Aliases

CVE-2024-1874

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-1874"
      ],
      "details": "In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\u00a0\n\n",
      "id": "GSD-2024-1874",
      "modified": "2024-02-25T06:02:56.350451Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@php.net",
        "ID": "CVE-2024-1874",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "PHP",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "not down converted",
                          "x_cve_json_5_version_data": {
                            "defaultStatus": "affected",
                            "versions": [
                              {
                                "lessThan": "8.1.28",
                                "status": "affected",
                                "version": "8.1.*",
                                "versionType": "semver"
                              },
                              {
                                "lessThan": "8.2.18",
                                "status": "affected",
                                "version": "8.2.*",
                                "versionType": "semver"
                              },
                              {
                                "lessThan": "8.3.5",
                                "status": "affected",
                                "version": "8.3.*",
                                "versionType": "semver"
                              }
                            ]
                          }
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "PHP Group"
            }
          ]
        }
      },
      "configuration": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This problem only present in Windows versions of PHP.\u0026nbsp;"
            }
          ],
          "value": "This problem only present in Windows versions of PHP.\u00a0"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "RyotaK"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\u00a0\n\n"
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-116",
                "lang": "eng",
                "value": "CWE-116 Improper Encoding or Escaping of Output"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7",
            "refsource": "MISC",
            "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
          }
        ]
      },
      "source": {
        "advisory": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254",
        "discovery": "EXTERNAL"
      },
      "work_around": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Using proc_open() string syntax avoids the problem.\u0026nbsp;"
            }
          ],
          "value": "Using proc_open() string syntax avoids the problem.\u00a0"
        }
      ]
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\u00a0\n\n"
          }
        ],
        "id": "CVE-2024-1874",
        "lastModified": "2024-04-29T04:15:07.580",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.5,
              "source": "security@php.net",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-04-29T04:15:07.580",
        "references": [
          {
            "source": "security@php.net",
            "url": "https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7"
          }
        ],
        "sourceIdentifier": "security@php.net",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-116"
              }
            ],
            "source": "security@php.net",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

hsec-2024-0003

Vulnerability from osv_haskell

Published

2025-11-14 14:45

Modified

2025-11-14 14:45

Summary

process: command injection via argument list on Windows

Details

process: command injection via argument list on Windows

The process library on Windows is vulnerable to a command injection vulnerability, via cmd.exe's interpretation of arguments. Programs that invoke batch files (.bat, .cmd) and pass arguments whose values are affected by program inputs may be affected.

This issue was discovered in many programming languages' Windows process execution behaviour. It was tracked by CERT/CC as VU#123335 and a coordinated disclosure was made on 2024-04-09 17:00 UTC.

A fix was released in process-1.6.19.0.

Background

Unlike POSIX systems, Windows does not have a mechanism for passing multiple arguments.Command line parsing is up to individual programs.

The process library defines the RawCommand constructor for specifying an executable and its arguments:

data CmdSpec
  = ShellCommand String
  | RawCommand FilePath [String]

On Windows, the RawCommand executable name and arguments are serialised into a single command line string, with separate arguments quoted separately. process then invokes the Windows CreateProcess routine with this command line string is given as the lpCommandLine argument.

Issue

When executing .bat or .cmd files, CreateProcess implicitly spawns cmd.exe. The System.Process command line construction does not escape characters with special meaning to cmd.exe. As a consequence, a command injection vulnerability arises when the following conditions are satisfied:

Program running on Windows
Program executes a .bat or .cmd file
The argument values include or are influenced by program input

Demonstration

The following batch file, test.bat, merely prints the executable name the first two arguments (as interpreted by cmd.exe):

@ECHO OFF
ECHO 0: %0
ECHO 1: %1
ECHO 2: %2
PAUSE

The following Haskell program executes test.bat with basic string arguments. The output is as expected:

λ> readProcess "test.bat" ["a","b"] [] >>= putStrLn
0: "test.bat"
1: "a"
2: "b"

However, we can use a close quote and the & character to induce cmd.exe to execute a program named in the argument:

λ> readProcess "test.bat" ["\"&calc.exe"] [] >>= putStrLn
0: "test.bat"
1: "\"
2:

In addition to producing the above output, calc.exe is executed.

Mitigation

The lack of a general mechanism on Windows for safely conveying command line arguments to programs increases the risk of this kind of security issue. The fact that cmd.exe command line parsing is complex and poorly documented exacerbates this issue, and also heightens the risk that the fix is incomplete, or causes other issues.

If possible, avoid executing batch files where arguments include or are influenced by untrusted program inputs. If it must be done, reject arguments that include special characters including & and ".

Fix versions

process was modified to perform additional escaping and quoting when executing .bat and .cmd files on Windows (ignoring character case). The behaviour is unchanged in all other cases.

The fix was released in process-1.6.19.0. The following GHC releases were the first in their series to include a fixed version of the process library:

GHC 9.10.1-alpha3 (released 2024-04-15)
GHC 9.8.3 (released 2024-10-20)
GHC 9.6.5 (released 2024-04-16)

Such a change in semantics should normally result in a major version bump. Because we expect very few (if any) users will be impacted by the behavioural change, the GHC team made a pragmatic decision to avoid the disruption that a major version bump would cause.

A follow-up fix was released in process-1.6.23.0 to handle batch scripts with paths ending in whitespace and periods and unescaped % expansions.

Acknowledgements

Security researcher RyotaK discovered and responsibly disclosed this vulnerability, coordinating the response across the many affected langauges and ecosystems.

Ben Gamari commited and released the fix, which was based on a proposal by Fraser Tweedale. Fraser also improved the System.Process module documentation to better explain the Windows semantics.

Security researcher Kainan Zhang (@4xpl0r3r) discovered and responsibly disclosing the issue in the first fix and the Rust Security Response WG coordinated the response.

References

URL

Type

	https://flatt.tech/research/posts/batbadbut-you-c…	ARTICLE
	https://kb.cert.org/vuls/id/123335	ADVISORY
	https://github.com/haskell/process/commit/3c419f9…	FIX
	https://github.com/haskell/process/commit/951b02d…	FIX
	https://github.com/haskell/process/commit/5fc91f5…	FIX

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "human_link": "https://github.com/haskell/security-advisories/tree/main/advisories/published/2024/HSEC-2024-0003.md",
        "osv": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export/2024/HSEC-2024-0003.json"
      },
      "package": {
        "ecosystem": "Hackage",
        "name": "process"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0.0"
            },
            {
              "fixed": "1.6.23.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-3566",
    "VU#123335"
  ],
  "database_specific": {
    "home": "https://github.com/haskell/security-advisories",
    "osvs": "https://raw.githubusercontent.com/haskell/security-advisories/refs/heads/generated/osv-export",
    "repository": "https://github.com/haskell/security-advisories"
  },
  "details": "# process: command injection via argument list on Windows\n\nThe *process* library on Windows is vulnerable to a command injection\nvulnerability, via `cmd.exe`\u0027s interpretation of arguments.  Programs that\ninvoke batch files (`.bat`, `.cmd`) and pass arguments whose values are\naffected by program inputs may be affected.\n\nThis issue was discovered in many programming languages\u0027 Windows process\nexecution behaviour.  It was tracked by CERT/CC as **VU#123335** and a\ncoordinated disclosure was made on 2024-04-09 17:00 UTC.\n\nA fix was released in *process-1.6.19.0*.\n\n\n## Background\n\nUnlike POSIX systems, Windows does not have a mechanism for passing multiple\narguments.Command line parsing is up to individual programs.\n\nThe *process* library defines the `RawCommand` constructor for specifying an\nexecutable and its arguments:\n\n```haskell\ndata CmdSpec\n  = ShellCommand String\n  | RawCommand FilePath [String]\n```\n\nOn Windows, the `RawCommand` executable name and arguments are serialised into\na single *command line* string, with separate arguments quoted separately.\n*process* then invokes the Windows [`CreateProcess`][doc-CreateProcess]\nroutine with this command line string is given as the `lpCommandLine`\nargument.\n\n[doc-CreateProcess]: https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa\n\n\n## Issue\n\nWhen executing `.bat` or `.cmd` files, [`CreateProcess`][doc-CreateProcess]\nimplicitly spawns `cmd.exe`.  The `System.Process` command line construction\ndoes not escape characters with special meaning to `cmd.exe`.  As a\nconsequence, a command injection vulnerability arises when the following\nconditions are satisfied:\n\n- Program running on Windows\n- Program executes a `.bat` or `.cmd` file\n- The argument values include or are influenced by program input\n\n\n## Demonstration\n\nThe following batch file, `test.bat`, merely prints the executable name the\nfirst two arguments (as interpreted by `cmd.exe`):\n\n```\n@ECHO OFF\nECHO 0: %0\nECHO 1: %1\nECHO 2: %2\nPAUSE\n```\n\nThe following Haskell program executes `test.bat` with basic string arguments.\nThe output is as expected:\n\n```\n\u03bb\u003e readProcess \"test.bat\" [\"a\",\"b\"] [] \u003e\u003e= putStrLn\n0: \"test.bat\"\n1: \"a\"\n2: \"b\"\n```\n\nHowever, we can use a close quote and the `\u0026` character to induce `cmd.exe` to\nexecute a program named in the argument:\n\n```\n\u03bb\u003e readProcess \"test.bat\" [\"\\\"\u0026calc.exe\"] [] \u003e\u003e= putStrLn\n0: \"test.bat\"\n1: \"\\\"\n2:\n```\n\nIn addition to producing the above output, `calc.exe` is executed.\n\n\n## Mitigation\n\nThe lack of a general mechanism on Windows for safely conveying command line\narguments to programs increases the risk of this kind of security issue.  The\nfact that `cmd.exe` command line parsing is complex and poorly documented\nexacerbates this issue, and also heightens the risk that the fix is\nincomplete, or causes other issues.\n\nIf possible, avoid executing batch files where arguments include or are\ninfluenced by untrusted program inputs.  If it must be done, reject arguments\nthat include special characters including `\u0026` and `\"`.\n\n\n## Fix versions\n\n*process* was modified to perform additional escaping and quoting\nwhen executing `.bat` and `.cmd` files on Windows (ignoring\ncharacter case).  The behaviour is unchanged in all other cases.\n\nThe fix was released in ***process-1.6.19.0***.  The following GHC\nreleases were the first in their series to include a fixed version\nof the *process* library:\n\n- **GHC 9.10.1-alpha3** (released 2024-04-15)\n- **GHC 9.8.3** (released 2024-10-20)\n- **GHC 9.6.5** (released 2024-04-16)\n\nSuch a change in semantics should normally result in a major version\nbump.  Because we expect very few (if any) users will be impacted by\nthe behavioural change, the GHC team made a pragmatic decision to\navoid the disruption that a major version bump would cause.\n\nA follow-up fix was released in ***process-1.6.23.0*** to handle batch\nscripts with paths ending in whitespace and periods and\nunescaped `%` expansions.\n\n\n## Acknowledgements\n\nSecurity researcher **RyotaK** discovered and responsibly disclosed\nthis vulnerability, coordinating the response across the many\naffected langauges and ecosystems.\n\nBen Gamari commited and released the fix, which was based on a\nproposal by Fraser Tweedale.  Fraser also improved the\n`System.Process` module documentation to better explain the Windows\nsemantics.\n\nSecurity researcher **Kainan Zhang** (@4xpl0r3r) discovered and\nresponsibly disclosing the issue in the first fix and the Rust\nSecurity Response WG coordinated the response.\n",
  "id": "HSEC-2024-0003",
  "modified": "2025-11-14T14:45:34Z",
  "published": "2025-11-14T14:45:34Z",
  "references": [
    {
      "type": "ARTICLE",
      "url": "https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/"
    },
    {
      "type": "ADVISORY",
      "url": "https://kb.cert.org/vuls/id/123335"
    },
    {
      "type": "FIX",
      "url": "https://github.com/haskell/process/commit/3c419f9eeedac024c9dccce544e5a6fb587179a5"
    },
    {
      "type": "FIX",
      "url": "https://github.com/haskell/process/commit/951b02dd95559b1a26f2456bfb97cf740ea40934"
    },
    {
      "type": "FIX",
      "url": "https://github.com/haskell/process/commit/5fc91f5f36ed4479be2b95f04f264bb78ac8089d"
    }
  ],
  "related": [
    "CVE-2024-1874",
    "CVE-2024-24576",
    "CVE-2024-22423"
  ],
  "schema_version": "1.5.0",
  "summary": "process: command injection via argument list on Windows"
}

MSRC_CVE-2024-1874

Vulnerability from csaf_microsoft - Published: 2024-04-02 07:00 - Updated: 2026-02-18 02:49

Summary

Command injection via array-ish $command parameter of proc_open()

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2024-1874

9.4 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

CWE-116 - Improper Encoding or Escaping of Output

Affected products

Fixed 2 products

Product	Identifier	Version	Remediation
Unresolved product id: 17719-17084		—
Unresolved product id: 17752-17084		—

Known affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: 17084-3		—	Vendor Fix fix
Unresolved product id: 17084-2		—	Vendor Fix fix

Known not affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 17086-1		—

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2024/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2024/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-1874 Command injection via array-ish $command parameter of proc_open() - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-1874.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Command injection via array-ish $command parameter of proc_open()",
    "tracking": {
      "current_release_date": "2026-02-18T02:49:02.000Z",
      "generator": {
        "date": "2026-02-18T08:20:17.615Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-1874",
      "initial_release_date": "2024-04-02T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-04-29T00:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2024-06-30T07:00:00.000Z",
          "legacy_version": "1.2",
          "number": "2",
          "summary": "Information published."
        },
        {
          "date": "2026-02-18T02:49:02.000Z",
          "legacy_version": "1.3",
          "number": "3",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              },
              {
                "category": "product_version",
                "name": "2.0",
                "product": {
                  "name": "CBL Mariner 2.0",
                  "product_id": "17086"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cazl3 php 8.3.8-1",
                "product": {
                  "name": "\u003cazl3 php 8.3.8-1",
                  "product_id": "3"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 php 8.3.8-1",
                "product": {
                  "name": "azl3 php 8.3.8-1",
                  "product_id": "17719"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cazl3 php 8.3.6-1",
                "product": {
                  "name": "\u003cazl3 php 8.3.6-1",
                  "product_id": "2"
                }
              },
              {
                "category": "product_version",
                "name": "azl3 php 8.3.6-1",
                "product": {
                  "name": "azl3 php 8.3.6-1",
                  "product_id": "17752"
                }
              }
            ],
            "category": "product_name",
            "name": "php"
          },
          {
            "category": "product_name",
            "name": "cbl2 php 8.1.22-2",
            "product": {
              "name": "cbl2 php 8.1.22-2",
              "product_id": "1"
            }
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 php 8.3.8-1 as a component of Azure Linux 3.0",
          "product_id": "17084-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 php 8.3.8-1 as a component of Azure Linux 3.0",
          "product_id": "17719-17084"
        },
        "product_reference": "17719",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "\u003cazl3 php 8.3.6-1 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 php 8.3.6-1 as a component of Azure Linux 3.0",
          "product_id": "17752-17084"
        },
        "product_reference": "17752",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cbl2 php 8.1.22-2 as a component of CBL Mariner 2.0",
          "product_id": "17086-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17086"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-1874",
      "cwe": {
        "id": "CWE-116",
        "name": "Improper Encoding or Escaping of Output"
      },
      "flags": [
        {
          "label": "component_not_present",
          "product_ids": [
            "17086-1"
          ]
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "php",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "fixed": [
          "17719-17084",
          "17752-17084"
        ],
        "known_affected": [
          "17084-3",
          "17084-2"
        ],
        "known_not_affected": [
          "17086-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-1874 Command injection via array-ish $command parameter of proc_open() - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-1874.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-04-29T00:00:00.000Z",
          "details": "8.3.8-1:Security Update:https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade",
          "product_ids": [
            "17084-3",
            "17084-2"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 9.4,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "17084-3",
            "17084-2"
          ]
        }
      ],
      "title": "Command injection via array-ish $command parameter of proc_open()"
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-1874 (GCVE-0-2024-1874)

Solution

Solutions

Solution

Solutions

Vulnerability from bitnami_vulndb

Vulnerability from bitnami_vulndb

Vulnerability from osv_haskell

process: command injection via argument list on Windows

Background

Issue

Demonstration

Mitigation

Fix versions

Acknowledgements

Tags

Sightings

Nomenclature