Log in Start free

Vulnerability · Published Apr 29, 2024 · Assigned by php

CVE-2024-1874Command injection via array-ish $command parameter of proc_open()

Critical 9.4

In plain English

A critical-severity security flaw in PHP from PHP Group. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 32.8% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.4Critical
Exploit odds (30 days)32.8%top 1.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20php828.2.18-r0ALPINE-CVE-2024-1874
Alpine:v3.21php828.2.18-r0ALPINE-CVE-2024-1874
Alpine:v3.22php828.2.18-r0ALPINE-CVE-2024-1874
Alpine:v3.20php838.3.5-r0ALPINE-CVE-2024-1874
Alpine:v3.21php838.3.5-r0ALPINE-CVE-2024-1874
Alpine:v3.22php838.3.5-r0ALPINE-CVE-2024-1874
Alpine:v3.23php838.3.5-r0ALPINE-CVE-2024-1874
Alpine:v3.24php838.3.5-r0ALPINE-CVE-2024-1874

Affected products (as reported)

VendorProductVersions
PHP Group PHP 8.1.* – before 8.1.288.2.* – before 8.2.188.3.* – before 8.3.5

Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

References