OS Command Injection in PHP‑CGI (CVE‑2024‑4577) Enables Arbitrary Code Execution on Windows
What It Is — PHP 7.x/8.x running in CGI mode on Windows contains an OS command‑injection flaw. An attacker can supply crafted input that is passed to the underlying shell, achieving arbitrary code execution. The issue is a bypass of the long‑standing CVE‑2012‑1823 patch.
Exploitability — Publicly disclosed in the CISA Known Exploited Vulnerabilities catalog; no public PoC has been released, but the vulnerability is trivially exploitable when PHP‑CGI is exposed to untrusted input.
Affected Products — PHP Group’s Windows builds of PHP‑CGI (all supported 7.x and 8.x versions).
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for continuous scanning and rapid patch deployment to keep evidence of a defended posture.
- Secure Configuration – Highlights gaps when CGI mode is left enabled on production web servers, a control many auditors scrutinize.
- Audit Readiness – A patched, documented remediation path provides defensible proof for regulators and enterprise buyers demanding a trustworthy supply‑chain.
Recommended Actions
- Identify any Windows‑based PHP‑CGI instances in your environment.
- Apply the PHP Group’s security patch for CVE‑2024‑4577 immediately.
- Verify the patch via integrity checks and update your asset inventory.
- Incorporate the fix into your vulnerability‑management workflow and retain evidence of remediation for audit purposes.
Source: CISA KEV – CVE‑2024‑4577