What is CVE - 2024 - 4577 in PHP and How to Fix It on Windows

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• CVE - 2024 - 4577 lets attackers inject command - line arguments into PHP CGI on Windows, leading to remote code execution.
• Affected versions are PHP 8.3 < 8.3.8, 8.2 < 8.2.20, and 8.1 < 8.1.29.
• Fix the issue by upgrading PHP, disabling the CGI binary, or applying a temporary Apache rewrite rule.

What exactly is CVE - 2024 - 4577?

CVE - 2024 - 4577 is a flaw in the way PHP (all supported Windows builds) converts Unicode characters to ASCII when running in CGI mode. The Windows "Best - Fit" mapping turns a soft - hyphen (U+00AD) into a regular hyphen, allowing an attacker to inject additional command - line arguments such as -d allow_url_include=1 into the PHP process.

How does the vulnerability lead to remote code execution?

When a request contains a soft - hyphen character in the query string, the CGI binary treats it as a normal hyphen after conversion. The injected argument is then passed to the PHP interpreter, which can enable dangerous settings or execute arbitrary code. This works even if the server is patched against the older PHP - CGI RCE bug (CVE - 2012 - 1823).

Which PHP versions are vulnerable?

Only the three listed ranges receive official patches; older branches remain vulnerable with no fixes forthcoming.

What environments are most at risk?

The default configuration of XAMPP for Windows ships php-cgi.exe as a CGI handler, making XAMPP installations a common target. Any Windows server that exposes the PHP CGI binary to the web is at risk.

How to mitigate the issue immediately

1. Upgrade PHP to a patched release (8.3.8, 8.2.20, 8.1.29 or later). This is the safest, long - term solution.
2. Disable PHP CGI if you cannot upgrade: remove the ScriptAlias /php-cgi/ line from Apache’s configuration or ensure the CGI binaries are not reachable from the internet.
3. Apply a temporary Apache rewrite rule that blocks requests containing the soft - hyphen (%ad) in the query string. Example:

RewriteEngine On
RewriteCond %{QUERY_STRING} ^%ad [NC]
RewriteRule .? - [F,L]

This rule works for the three locales confirmed vulnerable: Traditional Chinese, Simplified Chinese, and Japanese.

Verifying that the fix is in place

• After upgrading, run php -v and confirm the version is at least 8.3.8, 8.2.20, or 8.1.29.
• Check Apache config: grep -i "ScriptAlias /php-cgi/" /path/to/httpd.conf should return no results.
• Test the rewrite rule by requesting a URL with %ad in the query string; you should receive a 403 Forbidden response.

What to do if you cannot upgrade immediately?

If you must keep an older PHP version for compatibility, combine steps 2 and 3: disable the CGI handler and add the rewrite rule. Monitor logs for any 403 responses to ensure the rule is catching malicious requests.

Sources

• Ars Technica article detailing the bug, CVE number, affected versions and mitigation steps - https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/