Nasty bug with very simple exploit hits PHP just in time for the weekend

A essential vulnerability within the PHP programming language will be trivially exploited to execute malicious code on Home windows gadgets, safety researchers warned as they urged these affected to take motion earlier than the weekend begins.

Inside 24 hours of the vulnerability and accompanying patch being revealed, researchers from the nonprofit safety group Shadowserver reported Web scans designed to establish servers which might be vulnerable to assaults. That—mixed with (1) the convenience of exploitation, (2) the supply of proof-of-concept assault code, (3) the severity of remotely executing code on susceptible machines, and (4) the extensively used XAMPP platform being susceptible by default—has prompted safety practitioners to induce admins examine to see if their PHP servers are affected earlier than beginning the weekend.

When “Finest Match” is not

“A nasty bug with a quite simple exploit—good for a Friday afternoon,” researchers with safety agency WatchTowr wrote.

CVE-2024-4577, because the vulnerability is tracked, stems from errors in the way in which PHP converts unicode characters into ASCII. A feature constructed into Home windows often known as Finest Match permits attackers to make use of a method often known as argument injection to go user-supplied enter into instructions executed by an utility, on this case, PHP. Exploits permit attackers to bypass CVE-2012-1823, a essential code execution vulnerability patched in PHP in 2012.

“Whereas implementing PHP, the staff didn’t discover the Finest-Match characteristic of encoding conversion inside the Home windows working system,” researchers with Devcore, the safety agency that found CVE-2024-4577, wrote. “This oversight permits unauthenticated attackers to bypass the earlier safety of CVE-2012-1823 by particular character sequences. Arbitrary code will be executed on distant PHP servers by means of the argument injection assault.”

CVE-2024-4577 impacts PHP solely when it runs in a mode often known as CGI, through which an online server parses HTTP requests and passes them to a PHP script for processing. Even when PHP isn’t set to CGI mode, nevertheless, the vulnerability should be exploitable when PHP executables comparable to php.exe and php-cgi.exe are in directories which might be accessible by the online server. This configuration is about by default in XAMPP for Home windows, making the platform susceptible except it has been modified.

One instance, WatchTowr famous, happens when queries are parsed and despatched by means of a command line. The end result: a innocent request comparable to http://host/cgi.php?foo=bar may very well be transformed into php.exe cgi.php foo=bar, a command that might be executed by the primary PHP engine.

No escape

Like many different languages, PHP converts sure sorts of consumer enter to stop it from being interpreted as a command for execution. This can be a course of often known as escaping. For instance, in HTML, the < and > characters are sometimes escaped by changing them into their unicode hex worth equivalents < and > to stop them from being interpreted as HTML tags by a browser.

The WatchTowr researchers reveal how Finest Match fails to flee characters comparable to a delicate hyphen (with unicode worth 0xAD) and as an alternative converts it to an unescaped common hyphen (0x2D), a personality that’s instrumental in lots of code syntaxes.

The researchers went on to clarify:

It seems that, as a part of unicode processing, PHP will apply what’s often known as a ‘greatest match’ mapping, and helpfully assume that, when the consumer entered a delicate hyphen, they really supposed to sort a actual hyphen, and interpret it as such. Herein lies our vulnerability—if we provide a CGI handler with a delicate hyphen (0xAD), the CGI handler received’t really feel the necessity to escape it, and can go it to PHP. PHP, nevertheless, will interpret it as if it had been a actual hyphen, which permits an attacker to sneak additional command line arguments, which start with hyphens, into the PHP course of.

That is remarkably just like an older PHP bug (when in CGI mode), CVE-2012-1823, and so we will borrow some exploitation strategies developed for this older bug and adapt them to work with our new bug. A useful writeup advises that, to translate our injection into RCE, we should always purpose to inject the next arguments:

-d allow_url_include=1 -d auto_prepend_file=php://enter

This can settle for enter from our HTTP request physique, and course of it utilizing PHP. Simple sufficient – let’s strive a model of this outfitted with our 0xAD ‘delicate hyphen’ as an alternative of the same old hyphen. Perhaps it’s sufficient to slide by means of the escaping?

POST /take a look at.php?%ADd+allow_url_includepercent3d1+%ADd+auto_prepend_filepercent3dphp://enter HTTP/1.1
Host: {{host}}
Consumer-Agent: curl/8.3.0
Settle for: */*
Content material-Size: 23
Content material-Kind: utility/x-www-form-urlencoded
Connection: keep-alive


 

Oh pleasure—we’re rewarded with a phpinfo web page, displaying us we’ve certainly achieved RCE.

The vulnerability was found by Devcore researcher Orange Tsai, who said: “The bug is extremely easy, however that’s additionally what makes it attention-grabbing.”

The Devcore writeup stated that the researchers have confirmed that XAMPP is susceptible when Home windows is configured to make use of the locales for Conventional Chinese language, Simplified Chinese language, or Japanese. In Home windows, a locale is a set of consumer choice info associated to the consumer’s language, atmosphere, and/or cultural conventions. The researchers haven’t examined different locales and have urged folks utilizing them to carry out a complete asset evaluation to check their utilization eventualities.

CVE-2024-4577 impacts all variations of PHP working on a Home windows system. That features model branches 8.3 prior to eight.3.8, 8.2 prior to eight.2.20, and eight.1 prior to eight.1.29.

The 8.0, 7, and 5 model branches are additionally susceptible, however since they’re not supported, admins must observe mitigation recommendation since patches aren’t obtainable. One possibility is to use what are often known as rewrite guidelines comparable to:

RewriteEngine On
RewriteCond %{QUERY_STRING} ^%advert [NC]
RewriteRule .? - [F,L]

The researchers warning these guidelines have been examined just for the three locales they’ve confirmed as susceptible.

XAMPP for Home windows had but to launch a repair on the time this submit went stay. For admins with out the necessity for PHP CGI, they’ll flip it off utilizing the next Apache HTTP Server configuration:

C:/xampp/apache/conf/additional/httpd-xampp.conf

Finding the corresponding strains:

ScriptAlias /php-cgi/ "C:/xampp/php/"

And remark it out:

# ScriptAlias /php-cgi/ "C:/xampp/php/"

Extra evaluation of the vulnerability is obtainable here.