CVE-2024-56145

What it actually does

This vulnerability allows remote code or command execution in Craft CMS when PHP is configured with register_argc_argv enabled. With that PHP setting enabled, attacker-controlled request data can be exposed to the application as command-line style arguments. A crafted HTTP request can therefore influence Craft CMS execution flow and reach code-injection behavior, allowing commands or PHP code to run with the privileges of the web server/PHP process. The practical impact is unauthenticated remote execution on affected Craft CMS deployments that have the unsafe PHP setting enabled.

Why it matters to the business

Successful exploitation can result in full compromise of a public-facing Craft CMS site, including website defacement, malware deployment, credential and secret theft, data exposure, and use of the server as a foothold for further attacks. The risk is urgent: the vulnerability is in CISA KEV, has active in-the-wild exploitation, has a very high EPSS score of 0.97446, and the CISA remediation due date of 2025-06-23 has passed. Although the input does not indicate confirmed ransomware use, exploited web servers are commonly used for persistence, spam, phishing, cryptomining, and lateral movement.

How an attack unfolds

An attacker first identifies an internet-accessible Craft CMS instance and checks whether it behaves like a vulnerable deployment, particularly one running PHP with register_argc_argv enabled. The attacker then sends crafted HTTP requests containing command-line style arguments, commonly visible in logs as query strings with double-hyphen options or URL-encoded variants. Because PHP exposes those arguments to the application, Craft CMS can be driven into a vulnerable code path that evaluates or executes attacker-controlled input. Once code execution is achieved, the attacker typically runs reconnaissance commands, writes a web shell or backdoor, downloads additional tooling, accesses configuration files and secrets, and attempts persistence or movement to adjacent systems. Public reporting and exploitation activity have associated this issue with H1 2025 malware/vulnerability trend reporting and Craft CMS code-injection exploitation campaigns.

How to fix it

Upgrade Craft CMS to a version that includes the upstream fix, or if building directly from source, update to or beyond commit b2515b0ce6ae02e8582ce5a10841cb933899cbe3. Remove duplicate or stale Craft CMS source trees so only the fixed code is deployed. As an immediate mitigation, disable register_argc_argv in the PHP configuration used by the web SAPI by setting register_argc_argv = Off, then restart or reload PHP-FPM, Apache, or the relevant application runtime. Confirm the setting is disabled for the same PHP runtime serving web traffic, not only for the CLI PHP binary. If immediate patching is not possible, restrict access to the application at the edge, add temporary WAF detections for suspicious command-line style query strings, and increase monitoring for spawned shell processes and new PHP files. After remediation, rotate secrets that may have been accessible to the application if exploitation is suspected.

How to confirm the fix worked

Confirm the deployed Craft CMS code includes commit b2515b0ce6ae02e8582ce5a10841cb933899cbe3 or an official release containing that fix. Validate the effective PHP configuration for the web-serving runtime with phpinfo output from the same SAPI, PHP-FPM pool configuration, container image configuration, or php -i where applicable, and ensure register_argc_argv is Off for web requests. Review composer.lock or source-control metadata to confirm the fixed Craft CMS code is what is actually deployed. Restart PHP and web services after configuration changes and verify the old setting is not inherited from another php.ini, .user.ini, pool override, container layer, or hosting control panel. Perform a safe negative test by checking that web requests with command-line style query arguments are not interpreted as application argv input and that no suspicious application errors are produced. Confirm WAF or reverse-proxy rules are logging and blocking obvious exploit patterns such as query strings beginning with double-hyphen options.

Typical attack path

1. Scan the internet for Craft CMS sites or fingerprint candidate Craft CMS deployments.
2. Identify deployments likely running a vulnerable Craft CMS build with PHP register_argc_argv enabled.
3. Send crafted HTTP requests containing command-line style arguments in the query string, including double-hyphen or URL-encoded option patterns.
4. Trigger the vulnerable Craft CMS code path and obtain remote code execution under the web server/PHP process account.
5. Run operating-system reconnaissance commands and inspect application configuration for database credentials, API keys, and signing secrets.
6. Drop a web shell, loader, or other persistence mechanism into a writable web-accessible or application-controlled directory.
7. Use the compromised server for data theft, malware staging, traffic proxying, credential reuse, or further internal reconnaissance.

How to detect it

To determine whether exploitation already occurred, review web access logs, reverse-proxy logs, WAF events, Craft CMS logs, PHP-FPM logs, web server error logs, EDR process telemetry, file-integrity monitoring, and outbound network telemetry. Focus on requests to Craft CMS entry points with query strings that contain command-line style arguments, especially double-hyphen options, plus-separated arguments, and URL-encoded variants such as %2D%2D or %2B--. Correlate those requests with HTTP 500 responses, unusual application errors, or subsequent child processes spawned by PHP, Apache, or Nginx such as sh, bash, php -r, curl, wget, python, perl, or chmod. Inspect writable application and web directories for newly created or recently modified PHP files, suspicious template changes, unknown plugins, hidden files, or files with obfuscated code. Review application configuration access, environment secret access, database logins from the web host, and outbound connections shortly after suspicious requests. Because this vulnerability has active in-the-wild exploitation, absence of a web shell alone is not sufficient; also hunt for transient command execution, downloaded payloads, cron/systemd persistence, modified SSH authorized_keys files, and credential theft activity.

• register_argc_argv = On
• register_argc_argv=On
• GET /index.php?--
• POST /index.php?--
• GET /?--
• POST /?--
• GET /index.php?%2D%2D
• POST /index.php?%2D%2D
• GET /index.php?+--
• POST /index.php?+--
• %2B--
• %2D%2D
• /bin/sh -c
• /bin/bash -c
• php -r
• curl -fsSL
• wget http
• chmod +x /tmp/
• chmod +x /var/tmp/
• storage/logs/web.log
• storage/logs/phperrors.log
• web/cpresources/

What your security team should do

• Immediately inventory all Craft CMS deployments, including staging and marketing sites, and identify which ones use PHP with register_argc_argv enabled.
• Prioritize internet-facing Craft CMS instances for same-day remediation because this issue is in CISA KEV, actively exploited, and has a very high EPSS probability.
• Upgrade to a Craft CMS release containing commit b2515b0ce6ae02e8582ce5a10841cb933899cbe3 or deploy that fixed commit if running from Git.
• Disable register_argc_argv for web-serving PHP runtimes and verify the effective configuration after service restart.
• Search historical web, PHP, application, EDR, and file-integrity logs for exploitation patterns from the publication date forward, with emphasis on recent activity and periods before patching.
• Hunt for post-exploitation behavior: web-server child processes spawning shells, curl/wget downloads, unexpected PHP files, modified templates, new scheduled tasks, and outbound connections to unfamiliar hosts.
• If exploitation is suspected, preserve logs and disk artifacts, isolate the host, rotate application/database/API credentials, rebuild from known-good images, and review downstream systems accessed by the compromised application.
• Add WAF/SIEM detections for query strings containing command-line style arguments against Craft CMS endpoints and alert on suspicious child processes from php-fpm, Apache, or Nginx worker contexts.