PHP CGI²ÎÊý×¢ÈëÎó²î£¨CVE-2024-4577£© ÆÊÎö

Ðû²¼Ê±¼ä 2024-06-08

Ò»¡¢Îó²îÐÎò


2024Äê6ÔÂ6ÈÕ £¬PHP¹Ù·½Ðû²¼Á˶à¸öа汾 £¬ÆäÖж¼°üÀ¨¶Ô±àºÅΪCVE-2024-4577µÄÇå¾²Îó²îµÄÐÞ¸´¸üР¡£¸ÃÎó²îÊÇPHP CGIµÄ²ÎÊý×¢ÈëÎó²î £¬ÊǶÔCVE-2012-1823Îó²îµÄÐÞ¸´Èƹý ¡£


¸ÃÎó²î±¬·¢µÄÔµ¹ÊÔ­ÓÉÊÇ£ºÔÚPHP CGIģʽÏ £¬Î´×¼È·´¦Öóͷ£WindowsϵͳÖеġ°Best-Fit Mapping¡±ÌØÕ÷ £¬µ¼Ö¼òÌåÖÐÎÄ¡¢·±ÌåÖÐÎÄ¡¢ÈÕÎÄ»òÆäËûÊÜÓ°ÏìÓïÑÔÇéÐν«Ä³Ð©×Ö·û¹ýʧµÄʶ±ð³ÉÁË'-' ¡£¹¥»÷Õß¿Éͨ¹ýÒýÈë¶ñÒâ²ÎÊýʵÏÖí§Òâ´úÂëÖ´ÐÐ ¡£


¶þ¡¢Îó²î¸´ÏÖ


ÈçÏÂͼËùʾ£º


ͼƬ1.png


Èý¡¢Îó²îÆÊÎö


CVE-2012-1823²¹¶¡µÄÐÞ¸´²½·¥ÊÇ £¬PHP´¦Öóͷ£×ª´ï½øÀ´µÄ×Ö·û´®Ê± £¬ÔÚÌø¹ýÇ°Ãæ¿Õȱ·ûºó £¬ÅжϵÚһλÊÇ·ñÊÇ'-'£»ÈôÊÇÊÇ'-' £¬¾Í²î³ØºóÃæµÄ×Ö·û¾ÙÐвÎÊýÆÊÎö £¬ºÃ±È-d,-s,-cµÈ²ÎÊý ¡£


PHP¹Ù·½µÄcommitÈçÏÂͼËùʾ£º


ͼƬ2.png


¿ÉÒÔ¿´µ½ £¬µ±ÔËÐÐϵͳÇéÐÎΪWindowsʱ £¬PHPŲÓÃWideCharToMultiByteº¯ÊýÀ´ÔöÇ¿¶Ô¿í×Ö·ûµÄÅÐ¶Ï ¡£ÈôÊÇת»»ºóµÄ×Ö·ûΪ'-' £¬Ôò½«skip_getoptÖÃΪ1 £¬Ê¹µÃºóÐø¾Í²»»á¶Ô´«ÈëµÄ×Ö·û´®¾ÙÐвÎÊýÆÊÎö ¡£

ÄÇô £¬Ê²Ã´ÑùµÄ¿í×Ö·ûÄܹ»×ª»»ºóÄð³É'-' £¬´Ó¶øÈƹý֮ǰµÄÐÞ¸´ÄØ£¿


ÒÔÊÜÓ°ÏìµÄ¼òÌåÖÐÎÄ¡¢·±ÌåÖÐÎÄ¡¢ÈÕÎľÙÀý £¬ËûÃǶÔÓ¦µÄWindows ´úÂëÒ³»®·ÖÊÇ936¡¢950¡¢932 ¡£ÆäÖж¼Óн«0x00adÓ³ÉäΪ0x002dµÄ²Ù×÷ £¬ÈçÏÂͼËùʾ£º


ͼƬ3.png


ͼƬ4.png


ͼƬ5.png


Òò´Ëͨ¹ýÒýÈë0x00ad¼´¿ÉÌæ»»0x002d £¬ÊµÏÖ²ÎÊý×¢ÈëÀ´Ö´ÐÐí§Òâ´úÂë ¡£


ËÄ¡¢×ܽá


CVE-2024-4577Îó²îʹÓüòÆÓ £¬Î£º¦ÑÏÖØ ¡£ÌØÊâÔÚijЩ¶ÔApache¡¢PHP¾ÙÐм¯³É°²ÅźÍÖÎÀíµÄÊ¢ÐÐÈí¼þÖÐ £¬ÈôÊÇδ׼ȷÉèÖÃphp cgi £¬¼´¿ÉÔì³ÉÑÏÖØΣº¦ ¡£



²Î¿¼Á´½Ó£º


PHP¹Ù·½commit

https://github.com/php/php-src/commit/4dd9a36c165974c84c4217aa41849b70a9fc19c9

DEVCOREµÄÎó²îת´ï

https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability/