Full Report
A vulnerability initially exploited mostly in cyberattacks against Japanese organizations is now a potential problem worldwide, researchers said Friday.
Analysis Summary
# Vulnerability: Critical PHP-CGI Remote Code Execution (CVE-2024-4577)
## CVE Details
- CVE ID: CVE-2024-4577
- CVSS Score: Not explicitly provided, but exploitation demands 'immediate action' and targets RCE, indicating **High/Critical** severity.
- CWE: Not available in the text.
## Affected Systems
- Products: PHP scripts running via the PHP-CGI setup on web servers.
- Versions: All versions prior to the patch issued last summer (Summer 2024).
- Configurations: Affects environments using PHP in CGI mode.
## Vulnerability Description
The vulnerability resides in the PHP-CGI setup, allowing an attacker to remotely execute code (RCE) on the underlying web server. Researchers have identified at least 79 known ways to exploit this flaw to achieve code execution. The attacker's goal often involves stealing access credentials and establishing persistence, potentially leading to the deployment of a full command and control (C2) suite.
## Exploitation
- Status: **Exploited in the wild** (Observed predominantly targeting Japanese organizations initially, but exploitation patterns are now observed globally across multiple regions including the US and Singapore).
- Complexity: Implied to be relatively **Medium to Low** given the widespread exploitation observed by threat intelligence firms.
- Attack Vector: **Network** (Remote execution via web server interaction).
## Impact
- Confidentiality: High (Goals included stealing access credentials).
- Integrity: High (Allows execution of arbitrary code, deployment of adversarial tools).
- Availability: High (Potential for full system compromise).
## Remediation
### Patches
- A patch was **issued last summer (Summer 2024)**. Users must apply the relevant PHP update that addresses CVE-2024-4577.
### Workarounds
- Temporary mitigations are not detailed in the text, but organizations are urged to act immediately, suggesting rapid patching is the primary mitigation. It implies disabling or tightly restricting PHP-CGI execution if patching is delayed.
## Detection
- Indicators of compromise: Discovery of C2 servers communicating with compromised PHP servers, presence of adversarial tools, or signs of credential theft.
- Detection methods and tools: GreyNoise reported observing exploitation activity, suggesting security monitoring tools capable of tracking large-scale scanning/exploitation would be relevant.
## References
- Vendor advisories: A patch was issued last summer (Spring/Summer 2024 cycle).
- Relevant links - defanged:
- GreyNoise Analysis: ht_tps://www.greynoise.io/blog/mass-exploitation-critical-php-cgi-vulnerability-cve-2024-457
- Cisco Talos Report: ht_tps://blog.talosintelligence.com/new-persistent-attacks-japan/
- Symantec Report (Earlier exploitation): ht_tps://therecord.media/hackers-malware-university-taiwan-backdoor