PHP-CGI Remote Code Execution (RCE) Vulnerability Urgent Security Advisory (CVE-2024-4577)

1. Vulnerability Overview & Root Cause

This vulnerability stems from an unexpected interaction between the Windows operating system's 'Best-Fit' character encoding mapping and the command-line argument processing of PHP-CGI. When converting wide-character Unicode strings to specific ANSI code pages (such as CP949, CP950, or CP932), the Windows Win32 API automatically maps unsupported characters to visually similar ASCII characters (Best-Fit behavior). Consequently, characters like the soft hyphen (0xAD) or full-width hyphen are converted into a standard hyphen ('-', 0x2D). Because PHP-CGI decodes query string parameters into command-line arguments without sufficient validation, these mapped hyphens bypass input filters and are interpreted as command-line options by the PHP binary.

2. Exploitation Mechanics & Attack Scenario

An attacker sends a crafted HTTP request containing specific character sequences (such as '%ad') in the query string. When Apache processes this request and invokes the PHP-CGI binary, the Win32 API translates '%ad' into '-'. This allows the attacker to inject command-line arguments directly into the PHP execution environment. In a typical exploitation scenario, the attacker injects the '-d' option to override PHP configuration directives, enabling 'allow_url_include=1' and setting 'auto_prepend_file=php://input'. By supplying arbitrary PHP code within the HTTP request body, the attacker achieves immediate remote code execution (RCE) on the target server.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in the CISA KEV catalog, this vulnerability represents an active and severe threat. Successful exploitation allows unauthenticated remote attackers to compromise the underlying operating system, leading to complete server takeover, lateral movement within the corporate network, deployment of ransomware, data exfiltration, and severe business disruption.