Cloudanix VulnDB

CVE-2024-8926

None

CVSS

—

EPSS

3.7%

Published

Oct 8, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A Windows-specific flaw in PHP lets attackers with the right language settings run their own commands or see the contents of scripts on the server.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Remote Code Execution
Component
Application
Class
Command Injection
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Bypasses prior CVE-2024-4577 mitigations on Windows under non-standard codepage configurations, allowing command-line option injection into the PHP binary via Best Fit codepage behavior and resulting in source disclosure or arbitrary PHP execution.

Why it matters to the business

Servers running PHP on Windows with certain language or codepage settings face risk of source code exposure or remote code execution; the issue affects the core PHP project and downstream components such as Nginx-UI, increasing exposure for any organization relying on these packages until upgrades are applied.

How an attack unfolds

An attacker sends a crafted HTTP request or input that triggers the Windows Best Fit codepage conversion, bypassing the existing character filters and passing PHP command-line options that cause the interpreter to execute attacker-supplied code or reveal script contents.

How to fix it

Upgrade PHP to 8.1.30, 8.2.24 or 8.3.12 (commit 773c0eda4ac8181c59a6510a39c37710679277a4) and Nginx-UI to 1.9.10-0.20231219195202-ec93ab05a3ec; avoid non-standard Windows codepage configurations where feasible.

How to confirm the fix worked

Verify installed PHP and Nginx-UI versions match or exceed the listed fixed releases; test that previously exploitable codepage inputs no longer result in option injection or source disclosure.

Typical attack path

  1. Scan for PHP 8.1 < 8.1.30, 8.2 < 8.2.24 or 8.3 < 8.3.12 on Windows hosts
  2. Detect or force a vulnerable non-standard Windows codepage configuration
  3. Craft input containing characters that trigger Best Fit mapping to inject -d or other PHP CLI flags
  4. Achieve source disclosure or arbitrary code execution on the server

How to detect it

Review web server and PHP error logs for anomalous invocations containing PHP CLI flags or unexpected source-file reads; correlate with Windows codepage changes or unusual process command lines.

What your security team should do

  • Apply the listed PHP and Nginx-UI upgrades immediately on all Windows deployments
  • Audit Windows codepage settings and standardize on UTF-8 or other safe configurations
  • Monitor vendor advisories for any additional downstream packages that embed the vulnerable PHP logic

The record

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows "Best Fit" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.

Affected packages

Ecosystem Package Introduced Fixed
Bitnami libphp 0 8.1.30
Bitnami php 0 8.1.30
Bitnami php-min 0 8.1.30
Debian:12 php8.2 0 8.2.24-1~deb12u1
Ubuntu:20.04:LTS php7.4 0 No fix
Ubuntu:22.04:LTS php8.1 0 No fix
Ubuntu:24.04:LTS php8.3 0 No fix
Ubuntu:Pro:14.04:LTS php5 0 No fix
Ubuntu:Pro:16.04:LTS php7.0 0 No fix
Ubuntu:Pro:18.04:LTS php7.2 0 No fix

Related vulnerabilities