Quick answer: CVE-2024-4577 is a critical flaw in PHP running in CGI mode on Windows servers, disclosed in June 2024. It let attackers run commands on vulnerable servers, including default XAMPP installations. Within days, criminals were exploiting it to plant web shells and deploy the TellYouThePass ransomware. The fix is to update PHP to version 8.3.8, 8.2.20 or 8.1.29 or later.
| Key facts | |
|---|---|
| Disclosed | June 2024 |
| Affected software | PHP in CGI mode on Windows, including default XAMPP installations |
| Type of attack | Remote code execution, used for web shells and ransomware |
| Exploited by | TellYouThePass ransomware operators, from as early as 8 June 2024 |
| Exposure | About 458,800 exposed PHP instances potentially vulnerable, according to Censys |
| Fix | PHP 8.3.8, 8.2.20 or 8.1.29 and later |
Timeline
- June 2024: Researchers at DEVCORE disclose the flaw and PHP releases fixed versions.
- 7 to 10 June 2024: Proof-of-concept exploit code becomes public.
- From 8 June 2024: Imperva detects attacks delivering the TellYouThePass ransomware.
What happened
PHP powers a large share of the web, including WordPress. In June 2024, researchers at DEVCORE disclosed CVE-2024-4577, a command injection flaw affecting PHP running in CGI mode on Windows. It bypassed protections added for an older flaw, CVE-2012-1823, by abusing how Windows converts certain characters (the “Best Fit” feature).
XAMPP, a popular package for running PHP on Windows, was vulnerable by default. Censys counted about 458,800 exposed PHP instances that could potentially be affected.
Ransomware within days
Imperva reported attacks exploiting the flaw from as early as 8 June 2024, linked to the TellYouThePass ransomware campaign. Attackers used the flaw to plant web shells and run the ransomware’s encryption on servers. TellYouThePass has been active since 2019 and had previously exploited a flaw in Apache ActiveMQ.
Who was at risk
Any organization running PHP-CGI on a Windows server that had not been updated, including small businesses running websites or internal tools on XAMPP. Many of these servers are set up once and forgotten, which is exactly what makes them attractive to attackers.
Lessons for your organization
- Keep PHP, your CMS and plugins on supported, patched versions, and turn on automatic updates where possible.
- Never expose development stacks such as XAMPP directly to the internet.
- Keep an inventory of every web server and website your organization runs.
- Watch the CISA Known Exploited Vulnerabilities catalog and patch listed flaws first.
- Keep offline backups of websites and databases.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. See what a zero-day exploit is and how it differs from a known flaw like this one. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Frequently asked questions
What is CVE-2024-4577?
A critical command injection flaw in PHP running in CGI mode on Windows that lets attackers run code on vulnerable servers.
Which PHP versions fix CVE-2024-4577?
PHP 8.3.8, 8.2.20 and 8.1.29 and later versions.
Was CVE-2024-4577 used in real attacks?
Yes. Within days of disclosure it was exploited to deliver the TellYouThePass ransomware.
