PHP CGI²ÎÊý×¢ÈëÎó²î£¨CVE-2024-4577£© ÆÊÎö

Ðû²¼Ê±¼ä 2024-06-08

Ò»¡¢Îó²îÐÎò


2024Äê6ÔÂ6ÈÕ£¬£¬£¬£¬£¬£¬ £¬PHP¹Ù·½Ðû²¼Á˶à¸öа汾£¬£¬£¬£¬£¬£¬ £¬ÆäÖж¼°üÀ¨¶Ô±àºÅΪCVE-2024-4577µÄÇå¾²Îó²îµÄÐÞ¸´¸üС£¡£¡£¸ÃÎó²îÊÇPHP CGIµÄ²ÎÊý×¢ÈëÎó²î£¬£¬£¬£¬£¬£¬ £¬ÊǶÔCVE-2012-1823Îó²îµÄÐÞ¸´Èƹý¡£¡£¡£


¸ÃÎó²î±¬·¢µÄÔµ¹ÊÔ­ÓÉÊÇ£ºÔÚPHP CGIģʽÏ£¬£¬£¬£¬£¬£¬ £¬Î´×¼È·´¦Öóͷ£WindowsϵͳÖеġ°Best-Fit Mapping¡±ÌØÕ÷£¬£¬£¬£¬£¬£¬ £¬µ¼Ö¼òÌåÖÐÎÄ¡¢·±ÌåÖÐÎÄ¡¢ÈÕÎÄ»òÆäËûÊÜÓ°ÏìÓïÑÔÇéÐν«Ä³Ð©×Ö·û¹ýʧµÄʶ±ð³ÉÁË'-'¡£¡£¡£¹¥»÷Õß¿Éͨ¹ýÒýÈë¶ñÒâ²ÎÊýʵÏÖí§Òâ´úÂëÖ´ÐС£¡£¡£


¶þ¡¢Îó²î¸´ÏÖ


ÈçÏÂͼËùʾ£º


ͼƬ1.png


Èý¡¢Îó²îÆÊÎö


CVE-2012-1823²¹¶¡µÄÐÞ¸´²½·¥ÊÇ£¬£¬£¬£¬£¬£¬ £¬PHP´¦Öóͷ£×ª´ï½øÀ´µÄ×Ö·û´®Ê±£¬£¬£¬£¬£¬£¬ £¬ÔÚÌø¹ýÇ°Ãæ¿Õȱ·ûºó£¬£¬£¬£¬£¬£¬ £¬ÅжϵÚһλÊÇ·ñÊÇ'-'£»£»£»£»£»ÈôÊÇÊÇ'-'£¬£¬£¬£¬£¬£¬ £¬¾Í²î³ØºóÃæµÄ×Ö·û¾ÙÐвÎÊýÆÊÎö£¬£¬£¬£¬£¬£¬ £¬ºÃ±È-d,-s,-cµÈ²ÎÊý¡£¡£¡£


PHP¹Ù·½µÄcommitÈçÏÂͼËùʾ£º


ͼƬ2.png


¿ÉÒÔ¿´µ½£¬£¬£¬£¬£¬£¬ £¬µ±ÔËÐÐϵͳÇéÐÎΪWindowsʱ£¬£¬£¬£¬£¬£¬ £¬PHPŲÓÃWideCharToMultiByteº¯ÊýÀ´ÔöÇ¿¶Ô¿í×Ö·ûµÄÅжÏ¡£¡£¡£ÈôÊÇת»»ºóµÄ×Ö·ûΪ'-'£¬£¬£¬£¬£¬£¬ £¬Ôò½«skip_getoptÖÃΪ1£¬£¬£¬£¬£¬£¬ £¬Ê¹µÃºóÐø¾Í²»»á¶Ô´«ÈëµÄ×Ö·û´®¾ÙÐвÎÊýÆÊÎö¡£¡£¡£

ÄÇô£¬£¬£¬£¬£¬£¬ £¬Ê²Ã´ÑùµÄ¿í×Ö·ûÄܹ»×ª»»ºóÄð³É'-'£¬£¬£¬£¬£¬£¬ £¬´Ó¶øÈƹý֮ǰµÄÐÞ¸´ÄØ£¿ £¿£¿£¿£¿


ÒÔÊÜÓ°ÏìµÄ¼òÌåÖÐÎÄ¡¢·±ÌåÖÐÎÄ¡¢ÈÕÎľÙÀý£¬£¬£¬£¬£¬£¬ £¬ËûÃǶÔÓ¦µÄWindows ´úÂëÒ³»®·ÖÊÇ936¡¢950¡¢932¡£¡£¡£ÆäÖж¼Óн«0x00adÓ³ÉäΪ0x002dµÄ²Ù×÷£¬£¬£¬£¬£¬£¬ £¬ÈçÏÂͼËùʾ£º


ͼƬ3.png


ͼƬ4.png


ͼƬ5.png


Òò´Ëͨ¹ýÒýÈë0x00ad¼´¿ÉÌæ»»0x002d£¬£¬£¬£¬£¬£¬ £¬ÊµÏÖ²ÎÊý×¢ÈëÀ´Ö´ÐÐí§Òâ´úÂë¡£¡£¡£


ËÄ¡¢×ܽá


CVE-2024-4577Îó²îʹÓüòÆÓ£¬£¬£¬£¬£¬£¬ £¬Î£º¦ÑÏÖØ¡£¡£¡£ÌØÊâÔÚijЩ¶ÔApache¡¢PHP¾ÙÐм¯³É°²ÅźÍÖÎÀíµÄÊ¢ÐÐÈí¼þÖУ¬£¬£¬£¬£¬£¬ £¬ÈôÊÇδ׼ȷÉèÖÃphp cgi£¬£¬£¬£¬£¬£¬ £¬¼´¿ÉÔì³ÉÑÏÖØΣº¦¡£¡£¡£



²Î¿¼Á´½Ó£º


PHP¹Ù·½commit

https://github.com/php/php-src/commit/4dd9a36c165974c84c4217aa41849b70a9fc19c9

DEVCOREµÄÎó²îת´ï

https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability/