PHP Vulnerability Exploited (CVE-2024-4577)

THE THREAT

On June 6th, DEVCORE disclosed a critical vulnerability in PHP on the Windows operating system. The vulnerability, tracked as CVE-2024-4577 (CVSS: 9.8), is a Remote Code Execution (RCE) vulnerability. Exploitation would allow a remote and unauthenticated threat actor to reveal the source code of scripts and run arbitrary code on vulnerable servers.

Proof-of-Concept (PoC) exploit code was publicly released only one day after the vulnerability was disclosed. Additionally, attacks exploiting the vulnerability have now been confirmed, with at least one ransomware group exploiting CVE-2024-4577 for initial access into victim organizations.

As exploitation is ongoing, it is critical that organizations immediately apply the relevant security patches to minimize the likelihood of impact.

What we’re doing about it

• eSentire’s Tactical Threat Response (TTR) team has developed new eSentire MDR for Network detections to identify exploitation attempts.
• eSentire Managed Vulnerability Service (MVS) has plugins in place to identify this vulnerability
• Threat hunts have been performed across the eSentire client base
• IP addresses associated with real-world attacks are blocked via the eSentire Global Block list
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches
  • PHP released a fix for the vulnerability in versions 8.3.8, 8.2.20, and 8.1.29; all previous versions are vulnerable
• If patching is not immediately possible, DEVCORE has provided temporary mitigations

Additional information

CVE-2024-4577 is due to the “Best-Fit” feature used within Windows operating system. The Best-Fit feature allows the replacement of characters in a command line; this may be abused by threat actors to pass options to PHP binary being run, leading to malicious outcomes.

The earliest identified real-world attacks have been traced back to June 7th. It is believed that multiple threat actor groups are already exploiting the recently released vulnerability. The availability of PoC exploit code significantly simplifies the attack process and enables even low skilled actors to take advantage of the vulnerability.

According to the company Imperva, the TellYouThePass ransomware group is exploiting CVE-2024-4577 to execute PHP code on the victim system and to run an HTML application file. The file contained a VBScript, which in turn resulted in the deployment of a .NET variant of TellYouThePass ransomware. This ransomware group is not sophisticated, but they have a track record of rapidly adopting public exploits for new vulnerabilities to enable victim compromise; past examples include CVE-2021-44228 (Log4j) and CVE-2023-46604.

TellYouThePass previously leveraging the Log4j vulnerability demonstrates how threat actors exploit widely publicized vulnerabilities to maximize impact, highlighting the importance of patch management. An effective patch management strategy can significantly mitigate the risk of one-day vulnerabilities. By promptly addressing security flaws, organizations can reduce their attack surface and prevent exploitation.

References:

[1] https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/
[2] https://nvd.nist.gov/vuln/detail/CVE-2024-4577
[3] https://www.imperva.com/blog/update-cve-2024-4577-quickly-weaponized-to-distribute-tellyouthepass-ransomware/
[4] https://www.esentire.com/security-advisories/critical-apache-zero-day-vulnerability