PHP on Windows 8.1.x < 8.1.29 / 8.2.x < 8.2.20 / 8.3.x < 8.3.8 Arbitrary Code Execution (CVE-2024-4577)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(214953);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/11/03");

  script_cve_id("CVE-2024-4577");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2024/07/03");

  script_name(english:"PHP on Windows 8.1.x < 8.1.29 / 8.2.x < 8.2.20 / 8.3.x < 8.3.8 Arbitrary Code Execution (CVE-2024-4577)");

  script_set_attribute(attribute:"synopsis", value:
"An application installed on the remote Windows host is affected by an arbitrary code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of PHP: Hypertext Preprocessor detected on the remote Windows host is 8.1.x prior to 8.1.29, 8.2.x prior
to 8.2.20, or 8.3.x prior to 8.3.8. It is, therefore, affected by an arbitrary code execution vulnerability:

  - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on
    Windows, if the system is set up to use certain code pages, Windows may use 'Best-Fit' behavior to replace
    characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP
    options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code
    of scripts, run arbitrary PHP code on the server, etc. (CVE-2024-4577)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.php.net/ChangeLog-8.php#8.1.29");
  script_set_attribute(attribute:"see_also", value:"https://www.php.net/ChangeLog-8.php#8.2.20");
  script_set_attribute(attribute:"see_also", value:"https://www.php.net/ChangeLog-8.php#8.3.8");
  script_set_attribute(attribute:"solution", value:
"Upgrade to PHP: Hypertext Preprocessor version 8.1.29, 8.2.20, 8.3.8, or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-4577");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_core", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'PHP CGI Argument Injection Remote Code Execution');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/06/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/06/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/02/04");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:php:php");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("php_win_installed.nbin");
  script_require_keys("installed_sw/PHP", "SMB/Registry/Enumerated");

  exit(0);
}

include('vcf.inc');
get_kb_item_or_exit('SMB/Registry/Enumerated');

var app_info = vcf::get_app_info(app:'PHP', win_local:TRUE);

var constraints = [
  { 'min_version' : '8.1', 'fixed_version' : '8.1.29' },
  { 'min_version' : '8.2', 'fixed_version' : '8.2.20' },
  { 'min_version' : '8.3', 'fixed_version' : '8.3.8' },
];

vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);