PHP CGI²ÎÊý×¢ÈëÎó²î£¨CVE-2024-4577£© ÆÊÎö
Ðû²¼Ê±¼ä 2024-06-08Ò»¡¢Îó²îÐÎò
2024Äê6ÔÂ6ÈÕ£¬PHP¹Ù·½Ðû²¼Á˶à¸öа汾£¬ÆäÖж¼°üÀ¨¶Ô±àºÅΪCVE-2024-4577µÄÇå¾²Îó²îµÄÐÞ¸´¸üС£¸ÃÎó²îÊÇPHP CGIµÄ²ÎÊý×¢ÈëÎó²î£¬ÊǶÔCVE-2012-1823Îó²îµÄÐÞ¸´Èƹý¡£
¸ÃÎó²î±¬·¢µÄÔµ¹ÊÔÓÉÊÇ£ºÔÚPHP CGIģʽÏ£¬Î´×¼È·´¦Öóͷ£WindowsϵͳÖеġ°Best-Fit Mapping¡±ÌØÕ÷£¬µ¼Ö¼òÌåÖÐÎÄ¡¢·±ÌåÖÐÎÄ¡¢ÈÕÎÄ»òÆäËûÊÜÓ°ÏìÓïÑÔÇéÐν«Ä³Ð©×Ö·û¹ýʧµÄʶ±ð³ÉÁË'-'¡£¹¥»÷Õß¿Éͨ¹ýÒýÈë¶ñÒâ²ÎÊýʵÏÖí§Òâ´úÂëÖ´ÐС£
¶þ¡¢Îó²î¸´ÏÖ
ÈçÏÂͼËùʾ£º

Èý¡¢Îó²îÆÊÎö
CVE-2012-1823²¹¶¡µÄÐÞ¸´²½·¥ÊÇ£¬PHP´¦Öóͷ£×ª´ï½øÀ´µÄ×Ö·û´®Ê±£¬ÔÚÌø¹ýÇ°Ãæ¿Õȱ·ûºó£¬ÅжϵÚһλÊÇ·ñÊÇ'-'£»ÈôÊÇÊÇ'-'£¬¾Í²î³ØºóÃæµÄ×Ö·û¾ÙÐвÎÊýÆÊÎö£¬ºÃ±È-d,-s,-cµÈ²ÎÊý¡£
PHP¹Ù·½µÄcommitÈçÏÂͼËùʾ£º
¿ÉÒÔ¿´µ½£¬µ±ÔËÐÐϵͳÇéÐÎΪWindowsʱ£¬PHPŲÓÃWideCharToMultiByteº¯ÊýÀ´ÔöÇ¿¶Ô¿í×Ö·ûµÄÅжϡ£ÈôÊÇת»»ºóµÄ×Ö·ûΪ'-'£¬Ôò½«skip_getoptÖÃΪ1£¬Ê¹µÃºóÐø¾Í²»»á¶Ô´«ÈëµÄ×Ö·û´®¾ÙÐвÎÊýÆÊÎö¡£
ÄÇô£¬Ê²Ã´ÑùµÄ¿í×Ö·ûÄܹ»×ª»»ºóÄð³É'-'£¬´Ó¶øÈƹý֮ǰµÄÐÞ¸´ÄØ£¿
ÒÔÊÜÓ°ÏìµÄ¼òÌåÖÐÎÄ¡¢·±ÌåÖÐÎÄ¡¢ÈÕÎľÙÀý£¬ËûÃǶÔÓ¦µÄWindows ´úÂëÒ³»®·ÖÊÇ936¡¢950¡¢932¡£ÆäÖж¼Óн«0x00adÓ³ÉäΪ0x002dµÄ²Ù×÷£¬ÈçÏÂͼËùʾ£º
Òò´Ëͨ¹ýÒýÈë0x00ad¼´¿ÉÌæ»»0x002d£¬ÊµÏÖ²ÎÊý×¢ÈëÀ´Ö´ÐÐí§Òâ´úÂë¡£
ËÄ¡¢×ܽá
CVE-2024-4577Îó²îʹÓüòÆÓ£¬Î£º¦ÑÏÖØ¡£ÌØÊâÔÚijЩ¶ÔApache¡¢PHP¾ÙÐм¯³É°²ÅźÍÖÎÀíµÄÊ¢ÐÐÈí¼þÖУ¬ÈôÊÇδ׼ȷÉèÖÃphp cgi£¬¼´¿ÉÔì³ÉÑÏÖØΣº¦¡£
²Î¿¼Á´½Ó£º
PHP¹Ù·½commit
https://github.com/php/php-src/commit/4dd9a36c165974c84c4217aa41849b70a9fc19c9
DEVCOREµÄÎó²îת´ï
https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability/