{"schema":"threatline.record/2","record":{"id":"CVE-2024-4577","aliases":["GHSA-3qgc-jrrr-25jv"],"summary":"PHP-CGI OS Command Injection Vulnerability","details":"PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823.","categories":["Runtimes & languages"],"product":"PHP","vendor":"PHP Group","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4577","source_modified_at":"2025-10-21T23:05:16.089Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"PHP","vendor":"PHP Group","versions":[{"lessThan":"8.1.29","status":"affected","version":"8.1.*","versionType":"semver"},{"lessThan":"8.2.20","status":"affected","version":"8.2.*","versionType":"semver"},{"lessThan":"8.3.8","status":"affected","version":"8.3.*","versionType":"semver"}],"defaultStatus":"affected"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv","source_modified_at":"2024-09-28T17:37:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"PHP","ecosystem":null},"range":"< 8.3.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv","source_modified_at":"2024-09-28T17:37:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"PHP","ecosystem":null},"range":"< 8.2.20"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv","source_modified_at":"2024-09-28T17:37:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"PHP","ecosystem":null},"range":"< 8.1.29"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4577","source_modified_at":"2025-10-21T23:05:16.089Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"PHP","ecosystem":null},"version":"8.1.29","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4577","source_modified_at":"2025-10-21T23:05:16.089Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"PHP","ecosystem":null},"version":"8.2.20","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-4577","source_modified_at":"2025-10-21T23:05:16.089Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"PHP","ecosystem":null},"version":"8.3.8","basis":"first unaffected version stated in the CVE record"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv","source_modified_at":"2024-09-28T17:37:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"PHP","ecosystem":null},"version":"8.3.8"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv","source_modified_at":"2024-09-28T17:37:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"PHP","ecosystem":null},"version":"8.2.20"},{"source":"GitHub Advisory Database","source_url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv","source_modified_at":"2024-09-28T17:37:20Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"PHP","ecosystem":null},"version":"8.1.29"}],"cvss":9.8,"severity":"Critical","kev":{"listed":true,"date_added":"2024-06-12","due_date":"2024-07-03","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","ransomware_campaign_use":"Known"},"epss":{"probability":0.99987,"percentile":0.99984,"score_date":"2026-10-23"},"published_at":"2024-06-09T19:42:36.464Z","modified_at":"2025-10-21T23:05:16.089Z","provenance":[{"source":"CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T17:00:09.9001Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2024-4577","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-10-21T23:05:16.089Z"},{"source":"GitHub Advisory Database","url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2024-09-28T17:37:20Z"},{"source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/php_cgi_arg_injection_rce_cve_2024_4577.rb","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2024-06-06"},{"source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/52331","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2025-06-15"},{"source":"Nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4577.yaml","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":null},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-4577","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CISA KEV","CVE List","GitHub Advisory Database","Metasploit","Exploit-DB","Nuclei","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-4577","source":"CISA KEV"},{"source":"CVE List","url":"https://github.com/php/php-src/security/advisories/GHSA-3qgc-jrrr-25jv","tags":["x_transferred"]},{"source":"CVE List","url":"https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html","tags":["x_transferred"]},{"source":"CVE List","url":"https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/","tags":["x_transferred"]},{"source":"CVE List","url":"https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/","tags":["x_transferred"]},{"source":"CVE List","url":"https://www.imperva.com/blog/imperva-protects-against-critical-php-vulnerability-cve-2024-4577/","tags":["x_transferred"]},{"source":"CVE List","url":"https://github.com/11whoami99/CVE-2024-4577","tags":["x_transferred"]},{"source":"CVE List","url":"https://github.com/xcanwin/CVE-2024-4577-PHP-RCE","tags":["x_transferred"]},{"source":"CVE List","url":"https://github.com/rapid7/metasploit-framework/pull/19247","tags":["x_transferred"]},{"source":"CVE List","url":"https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/","tags":["x_transferred"]},{"source":"CVE List","url":"https://github.com/watchtowrlabs/CVE-2024-4577","tags":["x_transferred"]},{"source":"CVE List","url":"https://www.php.net/ChangeLog-8.php#8.1.29","tags":["x_transferred"]},{"source":"CVE List","url":"https://www.php.net/ChangeLog-8.php#8.2.20","tags":["x_transferred"]},{"source":"CVE List","url":"https://www.php.net/ChangeLog-8.php#8.3.8","tags":["x_transferred"]},{"source":"CVE List","url":"https://cert.be/en/advisory/warning-php-remote-code-execution-patch-immediately","tags":["x_transferred"]},{"source":"CVE List","url":"https://isc.sans.edu/diary/30994","tags":["x_transferred"]},{"source":"CVE List","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/","tags":["x_transferred"]},{"source":"CVE List","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/","tags":["x_transferred"]},{"source":"CVE List","url":"https://security.netapp.com/advisory/ntap-20240621-0008/","tags":["x_transferred"]},{"source":"CVE List","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577","tags":["government-resource"]},{"source":"CVE List","url":"https://www.vicarius.io/vsociety/posts/php-cgi-os-command-injection-vulnerability-cve-2024-4577"},{"source":"CVE List","url":"https://www.vicarius.io/vsociety/posts/php-cgi-argument-injection-to-rce-cve-2024-4577"},{"source":"CVE List","url":"https://blog.talosintelligence.com/new-persistent-attacks-japan/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"active","automatable":"yes","technical_impact":"total","assessed_at":"2024-06-15T03:55:28.430189Z"},"exploits":[{"source":"Metasploit","kind":"Exploit module","name":"PHP CGI Argument Injection Remote Code Execution","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/php_cgi_arg_injection_rce_cve_2024_4577.rb","date":"2024-06-06","added":"2026-06-02","check":true},{"source":"Exploit-DB","kind":"Webapps exploit","name":"PHP CGI Module 8.3.4 - Remote Code Execution (RCE)","url":"https://www.exploit-db.com/exploits/52331","date":"2025-06-15","added":"2025-06-15","verified":false},{"source":"Nuclei","kind":"Scanner template","name":"PHP CGI - Argument Injection","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4577.yaml"}],"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2025-10-21T23:05:16.089Z","content_hash":"5ada73b1a95aafbb757f831a3135bae82210bc71fd288feb49f9cb9c94e83e79"}}