PHP CGI Flaw CVE-2024-4577 Exploited to Deploy TellYouThePass Ransomware
Summary
CVE-2024-4577 enables unauthenticated remote code execution in vulnerable Windows PHP CGI setups. TellYouThePass reportedly exploited it after patches were released; users are advised to update or apply temporary mitigations.
Key points
- The flaw uses Windows encoding conversion’s Best-Fit behavior to bypass protections against argument injection and execute code remotely.
- Affected versions are PHP 8.3 before 8.3.8, 8.2 before 8.2.20, and 8.1 before 8.1.29; PHP 8.0, 7, and 5 are also considered vulnerable and are end-of-life.
- The article says exploitation was demonstrated on Windows systems using Traditional Chinese, Simplified Chinese, and Japanese locales; it reports no known exploitation for English and Western European locales.
- Wiz data indicated that 34% of cloud environments had Windows resources running vulnerable PHP versions.
- TellYouThePass reportedly began exploiting the flaw on June 8, 2024, using public exploit code to deploy webshells and ransomware.
- The reported attack chain uses mshta.exe to run an HTA containing VBScript, loads a .NET ransomware variant into memory, communicates with a command-and-control server, and encrypts files.
- Users should upgrade to a patched PHP version. The article also describes temporary rewrite rules for specified locales and recommends disabling PHP CGI in XAMPP if it is not needed.
Article Details
- Vulnerability Types
- Argument injection
- Severity
- Critical
- Affected Versions
- PHP 8.3 before 8.3.8
- PHP 8.2 before 8.2.20
- PHP 8.1 before 8.1.29
- PHP 8.0
- PHP 7
- PHP 5
- Exploitation Status
- active
- Exploit Availability
- public_exploit
- Patch Status
- available
- Workarounds
- Apply the provided Rewrite Rules as a temporary mitigation for Traditional Chinese, Simplified Chinese, and Japanese locales.
- XAMPP users who do not need PHP CGI should disable the feature by commenting out the relevant ScriptAlias line in the Apache HTTP Server configuration.
MITRE ATT&CK
T1059.005 · Visual BasicThe HTA file used by TellYouThePass contained VBScript.T1071.001 · Web ProtocolsThe ransomware sent an HTTP request disguised as a CSS resource request to a command-and-control server.T1140 · Deobfuscate/Decode Files or InformationA base64-encoded string in the HTA file was decoded into a binary.T1190 · Exploit Public-Facing ApplicationTellYouThePass exploited CVE-2024-4577 through PHP CGI on target servers to execute code remotely.T1218.005 · MshtaTellYouThePass used the Windows mshta.exe binary to run a malicious HTA file.T1486 · Data Encrypted for ImpactThe ransomware encrypted files on infected machines.
CVE
CVE-2012-1823Windows operating system. This allows unauthenticated attackers to bypass the previous protection of CVE-2012-1823 by using specific character sequences. The result is that arbitrary code can be executed on remote PHPCVE-2024-4577Researchers discovered a critical remote code execution vulnerability in PHP CGI, assigned CVE-2024-4577, affecting all Windows versions of PHP CGI. This vulnerability allows unauthenticated attackers to execute
Threat Actors
Products
PHPResearchers discovered a critical remote code execution vulnerability in PHP CGI, assigned CVE-2024-4577, affecting all Windows versions of PHP CGI. This vulnerability allows unauthenticated attackers to executeXAMPPThe attack scenarios include configurations running PHP under CGI mode or exposing the PHP binary, such as in XAMPP installations that are vulnerable by default.