Critical PHP-CGI OS Command Injection Vulnerability Identified

What changed

A vulnerability has been identified in the PHP-CGI module that affects PHP versions 8.1.* prior to 8.1.29, 8.2.* prior to 8.2.20, and 8.3.* prior to 8.3.8. This flaw arises when certain code pages are used, leading to potential command injection through misinterpreted characters.

• Allows malicious users to pass options to the PHP binary.
• Can lead to exposure of source code of scripts.
• Enables execution of arbitrary PHP code on the server.

Who is affected

This vulnerability primarily impacts organizations using specific versions of PHP in conjunction with Apache on Windows systems.

System administrators and developers utilizing these PHP versions should be aware of the risks.

• PHP versions 8.1.* before 8.1.29.
• PHP versions 8.2.* before 8.2.20.
• PHP versions 8.3.* before 8.3.8.
• Organizations running web applications on Windows with PHP-CGI.

What to do

It is crucial for affected users to upgrade to the latest PHP versions to mitigate this vulnerability. Regularly review and update configurations to minimize exposure.

Implement security best practices to safeguard against potential exploitation.

• Upgrade PHP to version 8.1.29 or later, 8.2.20 or later, or 8.3.8 or later.
• Review server configurations to ensure proper handling of command line inputs.
• Monitor for unusual activity that may indicate exploitation attempts.