PHP-CGI argument injection on Windows

PHP running as PHP-CGI behind Apache on Windows, when the system uses certain code pages. NVD lists the 8.1, 8.2 and 8.3 branches; earlier branches were already end of life.

Vulnerable versions: PHP 8.1 before 8.1.29, 8.2 before 8.2.20 and 8.3 before 8.3.8, when PHP runs as PHP-CGI behind Apache on Windows.

How it works

On Windows systems set up to use certain code pages, Windows may apply “Best-Fit” character replacement to the command line passed to PHP. The PHP-CGI module can then misread those characters as PHP options, letting a remote attacker pass options to the PHP binary. NVD notes this can reveal script source code or run arbitrary PHP code on the server.

Base score: 9.8 Critical (CVSS 3.1, NVD).

Related: php-cgi query string injection. This bypasses the protection added for CVE-2012-1823 on Windows.

1. Find any Windows server that runs PHP, including development and staging machines reachable from the internet.
2. Check how Apache hands requests to PHP. This vulnerability concerns the PHP-CGI handler, not mod_php or PHP-FPM.
3. Compare the PHP version with the fixed releases. Branches older than 8.1 were already end of life when this was published, so moving to a supported branch is the upstream route.
4. CISA lists this vulnerability as known to be exploited. If a vulnerable server was exposed, review it for signs of compromise as well as updating it.

Need this checked across your servers? A PHP response assessment records the runtime serving each site and its patch status, in writing.