Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2024-AVI-0468
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans PHP. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
Title | Publication Time | Tags | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "PHP versions 8.3.x ant\u00e9rieures \u00e0 8.3.8", "product": { "name": "N/A", "vendor": { "name": "PHP", "scada": false } } }, { "description": "PHP versions 8.2.x ant\u00e9rieures \u00e0 8.2.20", "product": { "name": "N/A", "vendor": { "name": "PHP", "scada": false } } }, { "description": "PHP versions 8.1.x ant\u00e9rieures \u00e0 8.1.29", "product": { "name": "N/A", "vendor": { "name": "PHP", "scada": false } } } ], "affected_systems_content": "", "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).", "cves": [ { "name": "CVE-2024-5458", "url": "https://www.cve.org/CVERecord?id=CVE-2024-5458" }, { "name": "CVE-2024-4577", "url": "https://www.cve.org/CVERecord?id=CVE-2024-4577" }, { "name": "CVE-2024-5585", "url": "https://www.cve.org/CVERecord?id=CVE-2024-5585" } ], "initial_release_date": "2024-06-07T00:00:00", "last_revision_date": "2024-06-07T00:00:00", "links": [], "reference": "CERTFR-2024-AVI-0468", "revisions": [ { "description": "Version initiale", "revision_date": "2024-06-07T00:00:00.000000" } ], "risks": [ { "description": "Ex\u00e9cution de code arbitraire \u00e0 distance" }, { "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es" }, { "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur" }, { "description": "Contournement de la politique de s\u00e9curit\u00e9" }, { "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans PHP. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.", "title": "Multiples vuln\u00e9rabilit\u00e9s dans PHP", "vendor_advisories": [ { "published_at": "2024-06-06", "title": "Bulletin de s\u00e9curit\u00e9 PHP 8.1.29", "url": "https://www.php.net/ChangeLog-8.php#8.1.29" }, { "published_at": "2024-06-06", "title": "Bulletin de s\u00e9curit\u00e9 PHP 8.2.20", "url": "https://www.php.net/ChangeLog-8.php#8.2.20" }, { "published_at": "2024-06-06", "title": "Bulletin de s\u00e9curit\u00e9 PHP 8.3.8", "url": "https://www.php.net/ChangeLog-8.php#8.3.8" } ] }
CVE-2024-4577 (GCVE-0-2024-4577)
Vulnerability from cvelistv5
Published
2024-06-09 19:42
Modified
2025-07-30 01:37
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
References
Impacted products
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:php_group:php:8.1.0:*:*:*:*:*:*:*" ], "defaultStatus": "affected", "product": "php", "vendor": "php_group", "versions": [ { "lessThan": "8.1.29", "status": "affected", "version": "8.1.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:a:php_group:php:8.2.0:*:*:*:*:*:*:*" ], "defaultStatus": "affected", "product": "php", "vendor": "php_group", "versions": [ { "lessThan": "8.2.20", "status": "affected", "version": "8.2.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:a:php_group:php:8.3.0:*:*:*:*:*:*:*" ], "defaultStatus": "affected", "product": "php", "vendor": "php_group", "versions": [ { "lessThan": "8.3.8", "status": "affected", "version": "8.3.0", "versionType": "custom" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-4577", "options": [ { "Exploitation": "active" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-06-15T03:55:28.430189Z", "version": "2.0.3" }, "type": "ssvc" } }, { "other": { "content": { "dateAdded": "2024-06-12", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577" }, "type": "kev" } } ], "providerMetadata": { "dateUpdated": "2025-07-30T01:37:01.605Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "timeline": [ { "lang": "en", "time": "2024-06-12T00:00:00+00:00", "value": "CVE-2024-4577 added to CISA KEV" } ], "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2025-03-14T01:24:54.997Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "url": "https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577" }, { "url": "https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577" }, { "url": "https://blog.talosintelligence.com/new-persistent-attacks-japan/" }, { "tags": [ "x_transferred" ], "url": "https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv" }, { "tags": [ "x_transferred" ], "url": "https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html" }, { "tags": [ "x_transferred" ], "url": "https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/" }, { "tags": [ "x_transferred" ], "url": "https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/" }, { "tags": [ "x_transferred" ], "url": "https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/" }, { "tags": [ "x_transferred" ], "url": "https://github.com/11whoami99/CVE-2024-4577" }, { "tags": [ "x_transferred" ], "url": "https://github.com/xcanwin/CVE-2024-4577-PHP-RCE" }, { "tags": [ "x_transferred" ], "url": "https://github.com/rapid7/metasploit-framework/pull/19247" }, { "tags": [ "x_transferred" ], "url": "https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/" }, { "tags": [ "x_transferred" ], "url": "https://github.com/watchtowrlabs/CVE-2024-4577" }, { "tags": [ "x_transferred" ], "url": "https://www.php.net/ChangeLog-8.php#8.1.29" }, { "tags": [ "x_transferred" ], "url": "https://www.php.net/ChangeLog-8.php#8.2.20" }, { "tags": [ "x_transferred" ], "url": "https://www.php.net/ChangeLog-8.php#8.3.8" }, { "tags": [ "x_transferred" ], "url": "https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately" }, { "tags": [ "x_transferred" ], "url": "https://isc.sans.edu/diary/30994" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20240621-0008/" } ], "title": "CVE Program Container", "x_generator": { "engine": "ADPogram 0.0.1" } } ], "cna": { "affected": [ { "defaultStatus": "affected", "modules": [ "CGI" ], "platforms": [ "Windows" ], "product": "PHP", "repo": "https://github.com/php/php-src", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.29", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.20", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.8", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "configurations": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "This problem is only present in Windows versions of PHP running in CGI mode, in systems where a codepage using \"Best Fit\" strategy is enabled.\u0026nbsp;\u003cbr\u003e" } ], "value": "This problem is only present in Windows versions of PHP running in CGI mode, in systems where a codepage using \"Best Fit\" strategy is enabled." } ], "credits": [ { "lang": "en", "type": "reporter", "value": "Orange Tsai, DEVCORE Research Team" } ], "datePublic": "2024-06-09T19:30:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "In PHP versions\u003cspan style=\"background-color: var(--wht);\"\u003e\u0026nbsp;8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eBest-Fit\" behavior to replace characters in command line given to\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWin32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.\u0026nbsp;\u003c/span\u003e\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e\u003cbr\u003e\u003c/span\u003e" } ], "value": "In PHP versions\u00a08.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to\u00a0Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-06-21T19:08:41.387Z", "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php" }, "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv" }, { "url": "https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html" }, { "url": "https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/" }, { "url": "https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/" }, { "url": "https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/" }, { "url": "https://github.com/11whoami99/CVE-2024-4577" }, { "url": "https://github.com/xcanwin/CVE-2024-4577-PHP-RCE" }, { "url": "https://github.com/rapid7/metasploit-framework/pull/19247" }, { "url": "https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/" }, { "url": "https://github.com/watchtowrlabs/CVE-2024-4577" }, { "url": "https://www.php.net/ChangeLog-8.php#8.1.29" }, { "url": "https://www.php.net/ChangeLog-8.php#8.2.20" }, { "url": "https://www.php.net/ChangeLog-8.php#8.3.8" }, { "url": "https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately" }, { "url": "https://isc.sans.edu/diary/30994" }, { "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/" }, { "url": "https://security.netapp.com/advisory/ntap-20240621-0008/" } ], "source": { "advisory": "GHSA-3qgc-jrrr-25jv", "discovery": "EXTERNAL" }, "title": "Argument Injection in PHP-CGI", "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "assignerShortName": "php", "cveId": "CVE-2024-4577", "datePublished": "2024-06-09T19:42:36.464Z", "dateReserved": "2024-05-06T22:21:01.742Z", "dateUpdated": "2025-07-30T01:37:01.605Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2024-5458 (GCVE-0-2024-5458)
Vulnerability from cvelistv5
Published
2024-06-09 18:26
Modified
2025-03-14 14:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.
References
URL | Tags | |||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Impacted products
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*" ], "defaultStatus": "affected", "product": "php", "vendor": "php", "versions": [ { "lessThanOrEqual": "7.3.33", "status": "affected", "version": "7.3.27", "versionType": "semver" }, { "lessThanOrEqual": "7.4.33", "status": "affected", "version": "7.4.15", "versionType": "semver" }, { "lessThanOrEqual": "8.0.30", "status": "affected", "version": "8.0.2", "versionType": "semver" }, { "lessThan": "8.1.29", "status": "affected", "version": "8.1.0", "versionType": "semver" }, { "lessThan": "8.2.20", "status": "affected", "version": "8.2.0", "versionType": "semver" }, { "lessThan": "8.3.8", "status": "affected", "version": "8.3.0", "versionType": "semver" } ] }, { "cpes": [ "cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*" ], "defaultStatus": "unknown", "product": "fedora", "vendor": "fedoraproject", "versions": [ { "status": "affected", "version": "40" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-5458", "options": [ { "Exploitation": "poc" }, { "Automatable": "yes" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-06-10T19:55:47.057816Z", "version": "2.0.3" }, "type": "ssvc" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-345", "description": "CWE-345 Insufficient Verification of Data Authenticity", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2025-03-14T14:13:20.514Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-01T21:11:12.787Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://github.com/php/php-src/security/advisories/GHSA-w8qr-v226-r27w" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/" }, { "tags": [ "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00009.html" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20240726-0001/" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "affected", "modules": [ "filter" ], "product": "PHP", "programFiles": [ "ext/filter/logical_filters.c" ], "repo": "https://github.com/php/php-src", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.29", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.20", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.8", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "credits": [ { "lang": "en", "type": "reporter", "value": "c01l" } ], "datePublic": "2024-06-09T18:00:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "In PHP versions\u003cspan style=\"background-color: var(--wht);\"\u003e\u0026nbsp;8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e(FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e\u003cbr\u003e\u003cbr\u003e\u003c/span\u003e" } ], "value": "In PHP versions\u00a08.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs\u00a0(FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "providerMetadata": { "dateUpdated": "2024-07-28T14:05:58.895Z", "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php" }, "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-w8qr-v226-r27w" }, { "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/" }, { "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00009.html" }, { "url": "https://security.netapp.com/advisory/ntap-20240726-0001/" } ], "source": { "advisory": "GHSA-w8qr-v226-r27w", "discovery": "EXTERNAL" }, "title": "Filter bypass in filter_var (FILTER_VALIDATE_URL)", "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "assignerShortName": "php", "cveId": "CVE-2024-5458", "datePublished": "2024-06-09T18:26:28.804Z", "dateReserved": "2024-05-29T00:23:37.703Z", "dateUpdated": "2025-03-14T14:13:20.514Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
CVE-2024-5585 (GCVE-0-2024-5585)
Vulnerability from cvelistv5
Published
2024-06-09 18:36
Modified
2025-02-13 17:54
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
References
URL | Tags | ||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Impacted products
{ "containers": { "adp": [ { "affected": [ { "cpes": [ "cpe:2.3:a:php:php:8.1.0:-:*:*:*:*:*:*" ], "defaultStatus": "affected", "product": "php", "vendor": "php", "versions": [ { "lessThan": "8.1.29", "status": "affected", "version": "8.1.0", "versionType": "semver" } ] }, { "cpes": [ "cpe:2.3:a:php:php:8.2.0:-:*:*:*:*:*:*" ], "defaultStatus": "affected", "product": "php", "vendor": "php", "versions": [ { "lessThan": "8.2.20", "status": "affected", "version": "8.2.0", "versionType": "semver" } ] }, { "cpes": [ "cpe:2.3:a:php:php:8.3.0:*:*:*:*:*:*:*" ], "defaultStatus": "affected", "product": "php", "vendor": "php", "versions": [ { "lessThan": "8.3.8", "status": "affected", "version": "8.3.0", "versionType": "semver" } ] } ], "metrics": [ { "other": { "content": { "id": "CVE-2024-5585", "options": [ { "Exploitation": "poc" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "timestamp": "2024-07-16T17:52:45.720953Z", "version": "2.0.3" }, "type": "ssvc" } } ], "providerMetadata": { "dateUpdated": "2024-07-16T18:15:25.949Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" }, { "providerMetadata": { "dateUpdated": "2024-08-19T07:35:25.799Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_transferred" ], "url": "https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385" }, { "tags": [ "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/" }, { "tags": [ "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20240726-0002/" }, { "url": "https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "defaultStatus": "affected", "modules": [ "proc_open" ], "platforms": [ "Windows" ], "product": "PHP", "repo": "https://github.com/php/php-src", "vendor": "PHP Group", "versions": [ { "lessThan": "8.1.29", "status": "affected", "version": "8.1.*", "versionType": "semver" }, { "lessThan": "8.2.20", "status": "affected", "version": "8.2.*", "versionType": "semver" }, { "lessThan": "8.3.8", "status": "affected", "version": "8.3.*", "versionType": "semver" } ] } ], "configurations": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "This problem only present in Windows versions of PHP. \u003cbr\u003e" } ], "value": "This problem only present in Windows versions of PHP." } ], "credits": [ { "lang": "en", "type": "reporter", "value": "tianstcht" } ], "datePublic": "2024-06-09T18:30:00.000Z", "descriptions": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "In PHP versions\u003cspan style=\"background-color: var(--wht);\"\u003e\u0026nbsp;8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for\u0026nbsp;\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCVE-2024-1874 does not work if the command name includes trailing spaces. Original issue:\u0026nbsp;\u003c/span\u003ewhen using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e\u003cbr\u003e\u003c/span\u003e" } ], "value": "In PHP versions\u00a08.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for\u00a0CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue:\u00a0when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE" } ] }, { "descriptions": [ { "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-07-28T14:06:03.143Z", "orgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "shortName": "php" }, "references": [ { "url": "https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385" }, { "url": "http://www.openwall.com/lists/oss-security/2024/06/07/1" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/" }, { "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/" }, { "url": "https://security.netapp.com/advisory/ntap-20240726-0002/" } ], "source": { "advisory": "GHSA-9fcc-425m-g385", "discovery": "EXTERNAL" }, "title": "Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)", "workarounds": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "Using proc_open() string syntax avoids the problem. \u003cbr\u003e" } ], "value": "Using proc_open() string syntax avoids the problem." } ], "x_generator": { "engine": "Vulnogram 0.2.0" } } }, "cveMetadata": { "assignerOrgId": "dd77f84a-d19a-4638-8c3d-a322d820ed2b", "assignerShortName": "php", "cveId": "CVE-2024-5585", "datePublished": "2024-06-09T18:36:50.477Z", "dateReserved": "2024-06-01T00:08:21.997Z", "dateUpdated": "2025-02-13T17:54:21.435Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1" }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…