PHP CGI Argument Injection Remote Code Execution (CVE-2024-4577)

CVE-2024-4577 is a critical argument injection flaw in PHP when running as CGI on Windows (also relevant on some Linux+Nginx+PHP-CGI setups). Attackers can pass crafted query strings that PHP mis-parses, leading to remote code execution without authentication.

Affected versions

• PHP 8.3 before 8.3.8
• PHP 8.2 before 8.2.20
• PHP 8.1 before 8.1.29
• Deployments using php-cgi.exe or CGI/FastCGI with vulnerable builds

Check your stack

php -v
ps aux | grep -E 'php-cgi|php-fpm'
grep -R 'cgi.fix_pathinfo' /etc/php* 2>/dev/null

Mitigation

• Upgrade PHP to a fixed release immediately
• Prefer PHP-FPM over legacy CGI on internet-facing hosts
• Block suspicious query strings at WAF/reverse proxy
• Review web logs for -d allow_url_include style probes

CVSS: 9.8 Critical. Active scanning observed within hours of disclosure.