Cloudanix VulnDB

CVE-2024-8927

None

CVSS

—

EPSS

1.1%

Published

Oct 8, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in certain PHP setups can let attackers trick the server into including and running files they should not have access to, which may expose sensitive information or allow unauthorized code execution.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability allows an attacker to control the HTTP_REDIRECT_STATUS environment variable via crafted HTTP headers, bypassing the cgi.force_redirect directive and enabling arbitrary file inclusion when PHP is run as a CGI binary under specific server configurations.

Why it matters to the business

Attackers may read or execute arbitrary files on affected PHP installations, risking exposure of sensitive application data, configuration files, or source code on web servers that rely on the bypassed security option.

How an attack unfolds

An attacker crafts an HTTP request containing headers that set HTTP_REDIRECT_STATUS, causing the PHP CGI binary to skip the expected redirect enforcement and treat the request as originating from a trusted internal source, resulting in inclusion of attacker-specified local or remote files.

How to fix it

Upgrade PHP to 8.1.30 or later, 8.2.24 or later, or 8.3.12 or later. For the Nginx-UI package, upgrade to version 1.9.10-0.20231219184941-827e76c46e63 or later. Verify that cgi.force_redirect remains enabled after the update and review any custom CGI configurations.

How to confirm the fix worked

Confirm installed PHP version is at or above the fixed releases; test that HTTP_REDIRECT_STATUS supplied via headers no longer bypasses cgi.force_redirect; review server logs for unexpected file inclusion attempts post-upgrade.

Typical attack path

  1. Identify a PHP application running under CGI mode with cgi.force_redirect enabled
  2. Send HTTP request with manipulated headers to set HTTP_REDIRECT_STATUS
  3. Supply a file inclusion parameter that references an arbitrary local or remote path
  4. Achieve file read or code execution depending on the included content

How to detect it

Review web server access logs and PHP error logs for requests that include HTTP_REDIRECT_STATUS headers combined with file inclusion parameters; look for unusual file paths or remote URLs in include operations.

What your security team should do

  • Apply the listed PHP version upgrades immediately due to the file inclusion risk in CGI setups
  • Audit all web servers for PHP CGI configurations and disable them where possible in favor of PHP-FPM or mod_php
  • Implement web application firewall rules to block requests containing HTTP_REDIRECT_STATUS headers from untrusted sources
  • Monitor for any downstream dependents of the affected packages and schedule coordinated updates

The record

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 apcu-panel 0 5.1.23-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 apcu-panel 0 5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 libzip 0 1.7.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 libzip 0 1.7.3-1.module_el8.6.0+2739+efabdb8f
AlmaLinux:8 libzip 0 1.7.3-1.module_el8.6.0+3061+6878dd1b
AlmaLinux:8 libzip 0 1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8 libzip 0 1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 libzip 0 1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 libzip-devel 0 1.7.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 libzip-devel 0 1.7.3-1.module_el8.6.0+3061+6878dd1b
AlmaLinux:8 libzip-devel 0 1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8 libzip-devel 0 1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 libzip-tools 0 1.7.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 libzip-tools 0 1.7.3-1.module_el8.6.0+2739+efabdb8f
AlmaLinux:8 libzip-tools 0 1.6.1-1.module_el8.10.0+3935+28808425
AlmaLinux:8 libzip-tools 0 1.6.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 libzip-tools 0 1.6.1-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 php 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-bcmath 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-bcmath 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-cli 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-cli 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-common 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-common 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-dba 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-dba 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-dbg 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-dbg 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-devel 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-devel 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-embedded 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-embedded 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-enchant 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-enchant 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-ffi 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-ffi 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-fpm 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-fpm 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-gd 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-gd 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-gmp 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-gmp 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-intl 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-intl 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-json 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-ldap 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-ldap 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-mbstring 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-mbstring 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-mysqlnd 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-mysqlnd 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-odbc 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-odbc 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-opcache 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-opcache 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pdo 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-pdo 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pear 0 1:1.10.14-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pear 0 1:1.10.13-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-apcu 0 5.1.23-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-apcu 0 5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-apcu 0 5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-apcu-devel 0 5.1.23-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-apcu-devel 0 5.1.18-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-apcu-devel 0 5.1.18-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-rrd 0 2.0.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.3.0+2009+b272fdef
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.4.0+2229+b272fdef
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-rrd 0 2.0.1-1.module_el8.6.0+3059+d65eee13
AlmaLinux:8 php-pecl-xdebug 0 2.9.5-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-xdebug 0 2.9.5-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-xdebug 0 2.9.5-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 php-pecl-xdebug3 0 3.2.2-2.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-zip 0 1.22.3-1.module_el8.10.0+3796+30ed3ef7
AlmaLinux:8 php-pecl-zip 0 1.18.2-1.module_el8.10.0+3935+28808425
AlmaLinux:8 php-pecl-zip 0 1.18.2-1.module_el8.6.0+2750+78feabcb
AlmaLinux:8 php-pecl-zip 0 1.18.2-1.module_el8.6.0+3239+bedf0508
AlmaLinux:8 php-pgsql 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-pgsql 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-process 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-process 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-snmp 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-snmp 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-soap 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-soap 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-xml 0 8.2.25-1.module_el8.10.0+3936+14b35499
AlmaLinux:8 php-xml 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:8 php-xmlrpc 0 7.4.33-2.module_el8.10.0+3935+28808425
AlmaLinux:9 apcu-panel 0 5.1.23-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 apcu-panel 0 5.1.21-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-bcmath 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-bcmath 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-cli 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-cli 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-common 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-common 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-dba 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-dba 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-dbg 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-dbg 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-devel 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-devel 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-embedded 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-embedded 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-enchant 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-enchant 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-ffi 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-ffi 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-fpm 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-fpm 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-gd 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-gd 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-gmp 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-gmp 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-intl 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-intl 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-ldap 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-ldap 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-mbstring 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-mbstring 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-mysqlnd 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-mysqlnd 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-odbc 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-odbc 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-opcache 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-opcache 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-pdo 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-pdo 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-pecl-apcu 0 5.1.23-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-apcu 0 5.1.21-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-apcu-devel 0 5.1.23-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-apcu-devel 0 5.1.21-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-rrd 0 2.0.3-4.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-rrd 0 2.0.3-4.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-xdebug3 0 3.2.2-2.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-xdebug3 0 3.1.4-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pecl-zip 0 1.22.3-1.module_el9.4.0+65+49ff6472
AlmaLinux:9 php-pecl-zip 0 1.20.1-1.module_el9.1.0+15+94ba28e4
AlmaLinux:9 php-pgsql 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-pgsql 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-process 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-process 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-snmp 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-snmp 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-soap 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-soap 0 8.1.30-1.module_el9.5.0+131+62ecd687
AlmaLinux:9 php-xml 0 8.2.25-1.module_el9.5.0+132+adb0ae7a
AlmaLinux:9 php-xml 0 8.1.30-1.module_el9.5.0+131+62ecd687
Bitnami libphp 0 8.1.30
Bitnami php 0 8.1.30
Bitnami php-min 0 8.1.30
Chainguard php-8.1 0 8.1.30-r0
Chainguard php-8.1-apache 0 8.1.30-r0
Chainguard php-8.1-bcmath 0 8.1.30-r0
Chainguard php-8.1-bcmath-config 0 8.1.30-r0
Chainguard php-8.1-bz2 0 8.1.30-r0
Chainguard php-8.1-bz2-config 0 8.1.30-r0
Chainguard php-8.1-calendar 0 8.1.30-r0
Chainguard php-8.1-calendar-config 0 8.1.30-r0
Chainguard php-8.1-cgi 0 8.1.30-r0
Chainguard php-8.1-config 0 8.1.30-r0
Chainguard php-8.1-ctype 0 8.1.30-r0
Chainguard php-8.1-ctype-config 0 8.1.30-r0
Chainguard php-8.1-curl 0 8.1.30-r0
Chainguard php-8.1-curl-config 0 8.1.30-r0
Chainguard php-8.1-dbg 0 8.1.30-r0
Chainguard php-8.1-dev 0 8.1.30-r0
Chainguard php-8.1-doc 0 8.1.30-r0
Chainguard php-8.1-dom 0 8.1.30-r0
Chainguard php-8.1-dom-config 0 8.1.30-r0
Chainguard php-8.1-exif 0 8.1.30-r0
Chainguard php-8.1-exif-config 0 8.1.30-r0
Chainguard php-8.1-fileinfo 0 8.1.30-r0
Chainguard php-8.1-fileinfo-config 0 8.1.30-r0
Chainguard php-8.1-fpm 0 8.1.30-r0
Chainguard php-8.1-fpm-config 0 8.1.30-r0
Chainguard php-8.1-ftp 0 8.1.30-r0
Chainguard php-8.1-ftp-config 0 8.1.30-r0
Chainguard php-8.1-gd 0 8.1.30-r0
Chainguard php-8.1-gd-config 0 8.1.30-r0
Chainguard php-8.1-gettext 0 8.1.30-r0
Chainguard php-8.1-gettext-config 0 8.1.30-r0
Chainguard php-8.1-gmp 0 8.1.30-r0
Chainguard php-8.1-gmp-config 0 8.1.30-r0
Chainguard php-8.1-iconv 0 8.1.30-r0
Chainguard php-8.1-iconv-config 0 8.1.30-r0
Chainguard php-8.1-intl 0 8.1.30-r0
Chainguard php-8.1-intl-config 0 8.1.30-r0
Chainguard php-8.1-ldap 0 8.1.30-r0
Chainguard php-8.1-ldap-config 0 8.1.30-r0
Chainguard php-8.1-mbstring 0 8.1.30-r0
Chainguard php-8.1-mbstring-config 0 8.1.30-r0
Chainguard php-8.1-mysqli 0 8.1.30-r0
Chainguard php-8.1-mysqli-config 0 8.1.30-r0
Chainguard php-8.1-mysqlnd 0 8.1.30-r0
Chainguard php-8.1-mysqlnd-config 0 8.1.30-r0

Related vulnerabilities