PHP CGI²ÎÊý×¢ÈëÎó²î£¨CVE-2024-4577£© ÆÊÎö

Ðû²¼Ê±¼ä 2024-06-08

Ò»¡¢Îó²îÐÎò


2024Äê6ÔÂ6ÈÕ£¬£¬ £¬PHP¹Ù·½Ðû²¼Á˶à¸öа汾£¬£¬ £¬ÆäÖж¼°üÀ¨¶Ô±àºÅΪCVE-2024-4577µÄÇå¾²Îó²îµÄÐÞ¸´¸üС£ ¡£¡£¡£¡£¡£¸ÃÎó²îÊÇPHP CGIµÄ²ÎÊý×¢ÈëÎó²î£¬£¬ £¬ÊǶÔCVE-2012-1823Îó²îµÄÐÞ¸´Èƹý¡£ ¡£¡£¡£¡£¡£


¸ÃÎó²î±¬·¢µÄÔµ¹ÊÔ­ÓÉÊÇ£ºÔÚPHP CGIģʽÏ£¬£¬ £¬Î´×¼È·´¦Öóͷ£WindowsϵͳÖеġ°Best-Fit Mapping¡±ÌØÕ÷£¬£¬ £¬µ¼Ö¼òÌåÖÐÎÄ¡¢·±ÌåÖÐÎÄ¡¢ÈÕÎÄ»òÆäËûÊÜÓ°ÏìÓïÑÔÇéÐν«Ä³Ð©×Ö·û¹ýʧµÄʶ±ð³ÉÁË'-'¡£ ¡£¡£¡£¡£¡£¹¥»÷Õß¿Éͨ¹ýÒýÈë¶ñÒâ²ÎÊýʵÏÖí§Òâ´úÂëÖ´ÐС£ ¡£¡£¡£¡£¡£


¶þ¡¢Îó²î¸´ÏÖ


ÈçÏÂͼËùʾ£º


ͼƬ1.png


Èý¡¢Îó²îÆÊÎö


CVE-2012-1823²¹¶¡µÄÐÞ¸´²½·¥ÊÇ£¬£¬ £¬PHP´¦Öóͷ£×ª´ï½øÀ´µÄ×Ö·û´®Ê±£¬£¬ £¬ÔÚÌø¹ýÇ°Ãæ¿Õȱ·ûºó£¬£¬ £¬ÅжϵÚһλÊÇ·ñÊÇ'-'£»£»£»£»£»£»ÈôÊÇÊÇ'-'£¬£¬ £¬¾Í²î³ØºóÃæµÄ×Ö·û¾ÙÐвÎÊýÆÊÎö£¬£¬ £¬ºÃ±È-d,-s,-cµÈ²ÎÊý¡£ ¡£¡£¡£¡£¡£


PHP¹Ù·½µÄcommitÈçÏÂͼËùʾ£º


ͼƬ2.png


¿ÉÒÔ¿´µ½£¬£¬ £¬µ±ÔËÐÐϵͳÇéÐÎΪWindowsʱ£¬£¬ £¬PHPŲÓÃWideCharToMultiByteº¯ÊýÀ´ÔöÇ¿¶Ô¿í×Ö·ûµÄÅжϡ£ ¡£¡£¡£¡£¡£ÈôÊÇת»»ºóµÄ×Ö·ûΪ'-'£¬£¬ £¬Ôò½«skip_getoptÖÃΪ1£¬£¬ £¬Ê¹µÃºóÐø¾Í²»»á¶Ô´«ÈëµÄ×Ö·û´®¾ÙÐвÎÊýÆÊÎö¡£ ¡£¡£¡£¡£¡£

ÄÇô£¬£¬ £¬Ê²Ã´ÑùµÄ¿í×Ö·ûÄܹ»×ª»»ºóÄð³É'-'£¬£¬ £¬´Ó¶øÈƹý֮ǰµÄÐÞ¸´ÄØ£¿£¿£¿£¿£¿


ÒÔÊÜÓ°ÏìµÄ¼òÌåÖÐÎÄ¡¢·±ÌåÖÐÎÄ¡¢ÈÕÎľÙÀý£¬£¬ £¬ËûÃǶÔÓ¦µÄWindows ´úÂëÒ³»®·ÖÊÇ936¡¢950¡¢932¡£ ¡£¡£¡£¡£¡£ÆäÖж¼Óн«0x00adÓ³ÉäΪ0x002dµÄ²Ù×÷£¬£¬ £¬ÈçÏÂͼËùʾ£º


ͼƬ3.png


ͼƬ4.png


ͼƬ5.png


Òò´Ëͨ¹ýÒýÈë0x00ad¼´¿ÉÌæ»»0x002d£¬£¬ £¬ÊµÏÖ²ÎÊý×¢ÈëÀ´Ö´ÐÐí§Òâ´úÂë¡£ ¡£¡£¡£¡£¡£


ËÄ¡¢×ܽá


CVE-2024-4577Îó²îʹÓüòÆÓ£¬£¬ £¬Î£º¦ÑÏÖØ¡£ ¡£¡£¡£¡£¡£ÌØÊâÔÚijЩ¶ÔApache¡¢PHP¾ÙÐм¯³É°²ÅźÍÖÎÀíµÄÊ¢ÐÐÈí¼þÖУ¬£¬ £¬ÈôÊÇδ׼ȷÉèÖÃphp cgi£¬£¬ £¬¼´¿ÉÔì³ÉÑÏÖØÎ£º¦¡£ ¡£¡£¡£¡£¡£



²Î¿¼Á´½Ó£º


PHP¹Ù·½commit

https://github.com/php/php-src/commit/4dd9a36c165974c84c4217aa41849b70a9fc19c9

DEVCOREµÄÎó²îת´ï

https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability/