CVE-2024-1874 Command injection via array-ish $command parameter of proc_open()

2024-04-2903:57:35

CWE-116

php

github.com

php

vulnerability

command injection

windows shell

CVSS3

9.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

AI Score

9.6

Confidence

High

EPSS

Percentile

10.3%

SSVC

Exploitation

poc

Automatable

yes

Technical Impact

total

JSON

In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

CNA Affected

[
  {
    "vendor": "PHP Group",
    "product": "PHP",
    "versions": [
      {
        "status": "affected",
        "version": "8.1.*",
        "lessThan": "8.1.28",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "8.2.*",
        "lessThan": "8.2.18",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "8.3.*",
        "lessThan": "8.3.5",
        "versionType": "semver"
      }
    ],
    "platforms": [
      "Windows"
    ],
    "defaultStatus": "affected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:php_group:php:8.1.0:*:*:*:*:*:*:*"
    ],
    "vendor": "php_group",
    "product": "php",
    "versions": [
      {
        "status": "affected",
        "version": "8.1.0"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:php_group:php:8.2.0:*:*:*:*:*:*:*"
    ],
    "vendor": "php_group",
    "product": "php",
    "versions": [
      {
        "status": "affected",
        "version": "8.2.0"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:a:php_group:php:8.3.0:*:*:*:*:*:*:*"
    ],
    "vendor": "php_group",
    "product": "php",
    "versions": [
      {
        "status": "affected",
        "version": "8.3.0"
      }
    ],
    "defaultStatus": "unknown"
  }
]