PHP CGI²ÎÊý×¢ÈëÎó²î£¨CVE-2024-4577£© ÆÊÎö

Ðû²¼Ê±¼ä 2024-06-08

Ò»¡¢Îó²îÐÎò


2024Äê6ÔÂ6ÈÕ £¬£¬£¬£¬£¬£¬PHP¹Ù·½Ðû²¼Á˶à¸öа汾 £¬£¬£¬£¬£¬£¬ÆäÖж¼°üÀ¨¶Ô±àºÅΪCVE-2024-4577µÄÇå¾²Îó²îµÄÐÞ¸´¸üР¡£¡£¸ÃÎó²îÊÇPHP CGIµÄ²ÎÊý×¢ÈëÎó²î £¬£¬£¬£¬£¬£¬ÊǶÔCVE-2012-1823Îó²îµÄÐÞ¸´Èƹý ¡£¡£


¸ÃÎó²î±¬·¢µÄÔµ¹ÊÔ­ÓÉÊÇ£ºÔÚPHP CGIģʽÏ £¬£¬£¬£¬£¬£¬Î´×¼È·´¦Öóͷ£WindowsϵͳÖеġ°Best-Fit Mapping¡±ÌØÕ÷ £¬£¬£¬£¬£¬£¬µ¼Ö¼òÌåÖÐÎÄ¡¢·±ÌåÖÐÎÄ¡¢ÈÕÎÄ»òÆäËûÊÜÓ°ÏìÓïÑÔÇéÐν«Ä³Ð©×Ö·û¹ýʧµÄʶ±ð³ÉÁË'-' ¡£¡£¹¥»÷Õß¿Éͨ¹ýÒýÈë¶ñÒâ²ÎÊýʵÏÖí§Òâ´úÂëÖ´ÐÐ ¡£¡£


¶þ¡¢Îó²î¸´ÏÖ


ÈçÏÂͼËùʾ£º


ͼƬ1.png


Èý¡¢Îó²îÆÊÎö


CVE-2012-1823²¹¶¡µÄÐÞ¸´²½·¥ÊÇ £¬£¬£¬£¬£¬£¬PHP´¦Öóͷ£×ª´ï½øÀ´µÄ×Ö·û´®Ê± £¬£¬£¬£¬£¬£¬ÔÚÌø¹ýÇ°Ãæ¿Õȱ·ûºó £¬£¬£¬£¬£¬£¬ÅжϵÚһλÊÇ·ñÊÇ'-'£»£»£»ÈôÊÇÊÇ'-' £¬£¬£¬£¬£¬£¬¾Í²î³ØºóÃæµÄ×Ö·û¾ÙÐвÎÊýÆÊÎö £¬£¬£¬£¬£¬£¬ºÃ±È-d,-s,-cµÈ²ÎÊý ¡£¡£


PHP¹Ù·½µÄcommitÈçÏÂͼËùʾ£º


ͼƬ2.png


¿ÉÒÔ¿´µ½ £¬£¬£¬£¬£¬£¬µ±ÔËÐÐϵͳÇéÐÎΪWindowsʱ £¬£¬£¬£¬£¬£¬PHPŲÓÃWideCharToMultiByteº¯ÊýÀ´ÔöÇ¿¶Ô¿í×Ö·ûµÄÅÐ¶Ï ¡£¡£ÈôÊÇת»»ºóµÄ×Ö·ûΪ'-' £¬£¬£¬£¬£¬£¬Ôò½«skip_getoptÖÃΪ1 £¬£¬£¬£¬£¬£¬Ê¹µÃºóÐø¾Í²»»á¶Ô´«ÈëµÄ×Ö·û´®¾ÙÐвÎÊýÆÊÎö ¡£¡£

ÄÇô £¬£¬£¬£¬£¬£¬Ê²Ã´ÑùµÄ¿í×Ö·ûÄܹ»×ª»»ºóÄð³É'-' £¬£¬£¬£¬£¬£¬´Ó¶øÈƹý֮ǰµÄÐÞ¸´ÄØ£¿£¿£¿


ÒÔÊÜÓ°ÏìµÄ¼òÌåÖÐÎÄ¡¢·±ÌåÖÐÎÄ¡¢ÈÕÎľÙÀý £¬£¬£¬£¬£¬£¬ËûÃǶÔÓ¦µÄWindows ´úÂëÒ³»®·ÖÊÇ936¡¢950¡¢932 ¡£¡£ÆäÖж¼Óн«0x00adÓ³ÉäΪ0x002dµÄ²Ù×÷ £¬£¬£¬£¬£¬£¬ÈçÏÂͼËùʾ£º


ͼƬ3.png


ͼƬ4.png


ͼƬ5.png


Òò´Ëͨ¹ýÒýÈë0x00ad¼´¿ÉÌæ»»0x002d £¬£¬£¬£¬£¬£¬ÊµÏÖ²ÎÊý×¢ÈëÀ´Ö´ÐÐí§Òâ´úÂë ¡£¡£


ËÄ¡¢×ܽá


CVE-2024-4577Îó²îʹÓüòÆÓ £¬£¬£¬£¬£¬£¬Î£º¦ÑÏÖØ ¡£¡£ÌØÊâÔÚijЩ¶ÔApache¡¢PHP¾ÙÐм¯³É°²ÅźÍÖÎÀíµÄÊ¢ÐÐÈí¼þÖÐ £¬£¬£¬£¬£¬£¬ÈôÊÇδ׼ȷÉèÖÃphp cgi £¬£¬£¬£¬£¬£¬¼´¿ÉÔì³ÉÑÏÖØΣº¦ ¡£¡£



²Î¿¼Á´½Ó£º


PHP¹Ù·½commit

https://github.com/php/php-src/commit/4dd9a36c165974c84c4217aa41849b70a9fc19c9

DEVCOREµÄÎó²îת´ï

https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability/