Research · Jun 9, 2024
Critical PHP-CGI OS Command Injection Vulnerability Discovered
A significant OS command injection vulnerability in PHP could allow attackers to execute arbitrary code and expose sensitive information, affecting multiple versions of PHP.
What changed
A newly identified OS command injection vulnerability in the PHP-CGI module poses serious security risks for users of certain PHP versions. This flaw arises when specific code pages are utilized in Windows environments, leading to potential misinterpretation of command line inputs.
- The vulnerability allows attackers to pass unintended options to the PHP binary.
- It can lead to the exposure of sensitive source code of scripts.
- Arbitrary PHP code execution on the server is also a possibility.
Who is affected
Several versions of PHP are impacted by this vulnerability, particularly those running on Windows with Apache and PHP-CGI configurations. Users of these versions should be aware of the potential risks.
- PHP versions 8.1.* before 8.1.29.
- PHP versions 8.2.* before 8.2.20.
- PHP versions 8.3.* before 8.3.8.
- Organizations utilizing PHP in their web applications on Windows platforms.
What to do
It is essential for users and organizations to take immediate action to mitigate the risks associated with this vulnerability. Updating to the latest versions of PHP is highly recommended.
- Upgrade to PHP 8.1.29 or later, 8.2.20 or later, or 8.3.8 or later.
- Review and adjust server configurations to minimize exposure.
- Monitor for any unusual activity that may indicate exploitation attempts.