CVE-2024-8926
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
Summary
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using certain non-standard configurations of Windows codepages, the fixes for a previous vulnerability (CVE-2024-4577) may be bypassed. This bypass can lead to command injection related to Windows "Best Fit" codepage behavior. The vulnerability potentially allows malicious users to pass options to the PHP binary being run, which could result in revealing the source code of scripts or running arbitrary PHP code on the server.
Impact
The impact of this vulnerability is severe, with a CVSS v3.1 base score of 8.1 (HIGH severity). It affects the confidentiality, integrity, and availability of the system, all rated as HIGH. Successful exploitation could allow attackers to: 1. Reveal the source code of PHP scripts, potentially exposing sensitive information or application logic. 2. Execute arbitrary PHP code on the affected server, which could lead to complete system compromise. 3. Potentially escalate privileges or perform other malicious actions depending on the server configuration and the attacker's capabilities. The vulnerability has a network attack vector, requires no user interaction, and no privileges, making it potentially attractive to attackers despite its high attack complexity.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available for this vulnerability. The issue has been addressed in PHP versions 8.1.30, 8.2.24, and 8.3.12 and later versions. Patch details were added on 2024-10-07, and there is an associated bugzilla entry (https://bugzilla.redhat.com/show_bug.cgi?id=2317050) for further information.
Mitigation
1. Update PHP installations to the patched versions immediately: 8.1.30 or later for the 8.1 branch, 8.2.24 or later for the 8.2 branch, and 8.3.12 or later for the 8.3 branch. 2. If immediate patching is not possible, implement additional security measures: - Restrict access to PHP installations, especially on Windows systems. - Review and tighten configurations related to Windows codepages. - Implement strict input validation and sanitization for any user-supplied data that might interact with PHP processes. 3. Conduct a thorough assessment of all PHP installations in your environment to identify affected systems. 4. Monitor the Red Hat security advisory (https://access.redhat.com/security/cve/cve-2024-8926) for any updated information or additional mitigation strategies. 5. After applying patches, verify that the fix has been successfully implemented and that systems are no longer vulnerable. 6. Consider implementing additional security layers, such as Web Application Firewalls (WAF), to help mitigate potential exploitation attempts.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
Feedly found the first article mentioning CVE-2024-8926. See article
Detection for the vulnerability has been added to Qualys (514132)
Detection for the vulnerability has been added to Qualys (514133)
Detection for the vulnerability has been added to Qualys (38961)
CVE-2024-8926 is a critical OS Command Injection vulnerability that allows remote attackers to execute arbitrary OS commands on the system due to improper input validation in the PHP-CGI implementation. The details provided do not specify a CVSS score, evidence of exploitation in the wild, proof-of-concept exploits, or available mitigations and patches. Additionally, there is no information regarding downstream impacts to other third-party vendors or technologies. See article
Feedly estimated the CVSS score as HIGH
Detection for the vulnerability has been added to Qualys (286178)
Detection for the vulnerability has been added to Nessus (208018)
Detection for the vulnerability has been added to Nessus (208048)