Command Injection Vulnerability in PHP 8.1, 8.2, and 8.3 due to Windows Codepage Misconfiguration
Summary
CVE-2024-8926: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6... Affects php8.2 across 2 version ranges.
< 8.2.24-1~deb12u1
>= 381ba9f5d0edd0c9c8ec1dea7e21d513ad08b115, < 773c0eda4ac8181c59a6510a39c37710679277a4
Fixed in 8.2.24-1~deb12u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PHP is a widely-used open-source scripting language designed for web development but also used as a general-purpose programming language. It is known for its ease of use, flexibility, and extensive community support. The affected versions of PHP, specifically 8.1.* before 8.1.30, 8.2.* before 8.2.24, and 8.3.* before 8.3.12, are vulnerable to command injection when certain non-standard configurations of Windows codepages are used. This vulnerability can lead to severe security risks, including unauthorized access to sensitive data and execution of arbitrary code.
Vulnerability Detail
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, and 8.3.* before 8.3.12, a vulnerability exists related to command injection due to improper handling of Windows 'Best Fit' codepage behavior. This issue arises when non-standard configurations of Windows codepages are employed, allowing malicious users to pass options to the PHP binary. Consequently, this could lead to the exposure of source code, execution of arbitrary PHP code on the server, and other significant security breaches.
How To Fix
Minimum fixed version
8.2.24-1~deb12u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php8.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using non-standard configurations of Windows codepages until the update is applied. Additionally, restricting access to the PHP binary and ensuring proper server configurations can mitigate potential risks.
Conclusion
The CVE-2024-8926 vulnerability poses a significant risk to PHP installations using specific Windows codepage configurations. It is crucial for users to update their PHP versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for php8.2 →
FAQ
CVE-2024-8926 is a vulnerability in PHP that allows command injection due to improper handling of Windows codepages.
PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, and 8.3.* before 8.3.12 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive data, execution of arbitrary PHP code, and potential exposure of the source code.
You can update PHP by running 'sudo apt-get update && sudo apt-get install php8.2' in your terminal to ensure you have the patched version.
Related vulnerabilities
Recent vulnerabilities recorded for php8.2.
