CVE-2024-1874
📋 TL;DR
This vulnerability allows remote command execution on Windows systems running vulnerable PHP versions. When using proc_open() with array syntax, insufficient argument escaping enables attackers to execute arbitrary shell commands. Affects PHP applications where user-controlled input is passed to proc_open() on Windows.
💻 Affected Systems
- PHP
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Php by Php
Php by Php
Php by Php
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the Windows server, allowing data theft, lateral movement, and persistent backdoor installation.
Likely Case
Remote code execution leading to web application compromise, data exfiltration, and potential ransomware deployment.
If Mitigated
Limited impact if proper input validation and escaping are implemented, though underlying vulnerability remains.
🎯 Exploit Status
Proof of concept available in security advisories. Exploitation is straightforward when user input reaches vulnerable code path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PHP 8.1.28, 8.2.18, 8.3.5
Vendor Advisory: https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7
Restart Required: Yes
Instructions:
1. Backup your PHP configuration and application. 2. Download and install patched PHP version from php.net. 3. Replace existing PHP installation. 4. Restart web server (Apache/Nginx) and PHP-FPM if used. 5. Test application functionality.
🔧 Temporary Workarounds
Input validation and escaping
allImplement strict input validation and escape shell arguments before passing to proc_open()
escapeshellarg($user_input) for each argument
filter_var($input, FILTER_VALIDATE_STRING) for validation
Disable proc_open() if unused
allRemove proc_open() from PHP disable_functions directive if not required
disable_functions = proc_open in php.ini
🧯 If You Can't Patch
- Implement strict input validation and escaping for all user inputs passed to proc_open()
- Use alternative functions like exec() with proper escaping instead of proc_open() with array syntax
🔍 How to Verify
Check if Vulnerable:
Check PHP version with php -v and verify if it's in affected range on Windows. Review code for proc_open() usage with array syntax and user input.Check Version:
php -v | grep "PHP"Verify Fix Applied:
Confirm PHP version is 8.1.28+, 8.2.18+, or 8.3.5+ using php -v command.📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from PHP context
- Suspicious command-line arguments in Windows event logs
- Multiple failed proc_open() attempts
Network Indicators:
- Outbound connections from web server to unexpected destinations
- Command and control traffic patterns
SIEM Query:
source="windows-security" EventID=4688 AND ProcessName="php*" AND CommandLine CONTAINS "cmd.exe" OR CommandLine CONTAINS "powershell"🔗 References
- http://www.openwall.com/lists/oss-security/2024/04/12/11
- http://www.openwall.com/lists/oss-security/2024/06/07/1
- https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
- https://security.netapp.com/advisory/ntap-20240510-0009/
- http://www.openwall.com/lists/oss-security/2024/04/12/11
- http://www.openwall.com/lists/oss-security/2024/06/07/1
- https://github.com/php/php-src/security/advisories/GHSA-pc52-254m-w9w7
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJZK3X6B7FBE32FETDSMRLJXTFTHKWSY/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZGWIK3HMBACERGB4TSBB2JUOMPYY2VKY/
- https://security.netapp.com/advisory/ntap-20240510-0009/
- https://www.kb.cert.org/vuls/id/123335
- https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585
