The article covers CVE-2024-4577, a critical PHP-CGI remote-code-execution vulnerability on Windows that prompted a patch on June 6, 2024. It also details early exploitation activity, linking the campaigns TellYouThePass and Muhstik to attempts and analyses by Cyble’s CGSI team. #TellYouThePass #Muhstik #RocketMQ #CGSI #CVE-2024-4577
Keypoints
- CVE-2024-4577 is a critical RCE in PHP running in CGI mode on Windows, caused by Best Fit character encoding conversions.
- A patch was released by the PHP development team on June 6, 2024.
- Imperva reported the first exploitation of the vulnerability by threat actors deploying ransomware under the TellYouThePass campaign (June 8, 2024).
- CGSI detected multiple scanning attempts from various locations, including an IP linked to Muhstik, suggesting payload delivery activity and possible links to RocketMQ-era actors.
- Muhstik is known for targeting IoT devices and Linux servers to enable cryptocurrency mining and DDoS activities.
- WatchTowr Labs published a PoC; CGSI observed live exploitation attempts shortly after the patch release.
- Recommendations include upgrading PHP to 8.3.8, 8.2.20, or 8.1.29 and conducting regular security audits and pentests.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – Exploitation of CVE-2024-4577 enables remote code execution on Windows PHP CGI. Quote: ‘Exploiting this flaw could potentially enable threat actors to remotely execute arbitrary code.’
- [T1059] Command and Scripting Interpreter – Attackers leverage the PHP-CGI process via the command line (e.g., executing ‘php.exe cgi.php foo=bar’ for a request). Quote: ‘For instance, query strings are parsed and sent to the PHP interpreter via the command line, such as executing php.exe cgi.php foo=bar for a request like http://host/cgi.php?foo=bar.’
Indicators of Compromise
- [IP] IP observed attempting to exploit CVE-2024-4577 – 51[.]79[.]19[.]53, 14[.]225[.]53[.]162, and 9 more (if applicable) – IP observed as part of exploitation attempts.
Read more: https://cyble.com/blog/cve-2024-4577-ongoing-exploitation-of-a-critical-php-vulnerability/