CVE-2024-4577: Critical PHP CGI Vulnerability on Windows Exploited by Ransomware Within Days

TL;DR: CVE-2024-4577 is a CVSS 9.8 argument injection in PHP CGI on Windows. It exploits Windows’ “Best-Fit” character encoding to bypass the decade-old CVE-2012-1823 protection using a soft hyphen (U+00AD → 0x2D). Affects XAMPP and any PHP CGI installation on Windows. Disclosed June 6, 2024. TellYouThePass ransomware weaponized it within 48 hours. Patch to PHP 8.1.29, 8.2.20, or 8.3.8 immediately.

Some vulnerability research is technically elegant. CVE-2024-4577, discovered by security researcher Orange Tsai of DEVCORE, is exactly that: a single-character bypass that defeats a 12-year-old security fix, delivering unauthenticated remote code execution on PHP servers running on Windows.

Within 48 hours of disclosure, working exploit code was publicly available. Within one week, the TellYouThePass ransomware group was actively deploying ransomware against Windows PHP servers at scale. This is the complete technical analysis.

The Backstory: CVE-2012-1823

To understand CVE-2024-4577, you must first understand its predecessor. In 2012, CVE-2012-1823 showed that PHP in CGI mode allowed attackers to inject command-line arguments via URL query strings — enabling arbitrary PHP execution. For example:

GET /index.php?-d+allow_url_include%3DOn+-d+auto_prepend_file%3Dphp%3A%2F%2Finput HTTP/1.1

# This passed "-d allow_url_include=On -d auto_prepend_file=php://input" as PHP CLI arguments
# Combined with malicious PHP code in the request body → arbitrary code execution

PHP patched this in 2012 by checking if the query string begins with a hyphen (0x2D) and rejecting such requests. That fix was considered solid. For 12 years.

The Windows Best-Fit Encoding Bypass

CVE-2024-4577 exploits a Windows-specific feature called “Best-Fit” character encoding mapping. When Windows converts Unicode characters to certain code pages (CP932 for Japanese, CP936 for Chinese Simplified, CP950 for Chinese Traditional, etc.), it maps certain Unicode characters to their nearest ASCII equivalents.

The critical character: Unicode U+00AD (SOFT HYPHEN) — an optional/conditional hyphen used in typography. Windows maps U+00AD to 0x2D (ASCII hyphen) during code page conversion.

The bypass:

• PHP’s CVE-2012-1823 fix checks if the query string byte starts with 0x2D (ASCII -)
• Attacker sends %AD (soft hyphen, URL-encoded) instead of -
• PHP’s check sees 0xAD, not 0x2D → validation passes
• Windows’ Best-Fit mapping converts 0xAD → 0x2D before PHP processes the CGI argument
• PHP executes with the injected arguments as if - was used originally

# CVE-2012-1823 — BLOCKED since 2012:
GET /php-cgi/php-cgi.exe?-d+allow_url_include%3DOn+-d+auto_prepend_file%3Dphp%3A%2F%2Finput

# CVE-2024-4577 BYPASS — using U+00AD (soft hyphen):
# %AD passes PHP's check; Windows converts %AD to - before CGI execution
GET /php-cgi/php-cgi.exe?%ADd+allow_url_include%3DOn+%ADd+auto_prepend_file%3Dphp%3A%2F%2Finput

# Malicious payload in POST body (auto_prepend_file=php://input):
# <?php system($_GET['cmd']); ?>

Affected Versions and Conditions

Required conditions:

• PHP running in CGI mode on Windows (XAMPP uses this by default)
• Apache or IIS configured to pass requests to php-cgi.exe
• Windows locale using a code page that maps U+00AD to 0x2D (Japanese, Chinese Simplified/Traditional, Korean, and others)

Not affected:

• PHP on Linux or macOS (no Best-Fit encoding issue)
• PHP-FPM (FastCGI Process Manager)
• mod_php (Apache module mode)

Real-World Exploitation: TellYouThePass Ransomware

CVE-2024-4577 was disclosed on June 6, 2024. The timeline of exploitation:

• June 6, 2024: Public disclosure by Orange Tsai / DEVCORE
• June 8, 2024: Multiple public PoC exploits published
• June 9–10, 2024: TellYouThePass ransomware actively deploying ransomware via CVE-2024-4577 against Windows+PHP servers
• June 2024 onwards: Multiple threat actor groups exploiting for initial access to corporate networks

TellYouThePass is a ransomware-as-a-service operation known for rapid weaponization of newly disclosed CVEs. Their campaign targeted Windows servers running XAMPP with vulnerable PHP versions, encrypting web content and demanding ransomware payments.

Detection

# Check web server access logs for exploitation attempts
grep -i "php-cgi" /var/log/apache2/access.log | grep -i "%ad"
grep -i "auto_prepend_file" /var/log/apache2/access.log
grep -i "allow_url_include" /var/log/apache2/access.log

# Hunt for web shells dropped by attackers (PowerShell on Windows)
Get-ChildItem -Path "C:xampphtdocs" -Filter "*.php" -Recurse |
    Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-30) } |
    Select-Object FullName, CreationTime | Sort-Object CreationTime -Descending

Patching and Remediation

Priority 1 — Update PHP immediately:

PHP 8.1.x  →  PHP 8.1.29
PHP 8.2.x  →  PHP 8.2.20
PHP 8.3.x  →  PHP 8.3.8

# XAMPP users: Update PHP via XAMPP Control Panel or download latest XAMPP
# Download: https://windows.php.net/download/

Priority 2 — Apache URL rewrite workaround:

# Add to httpd.conf or .htaccess to block direct php-cgi.exe access
<Files "php-cgi.exe">
    Order Allow,Deny
    Deny from all
</Files>

Priority 3 — Migrate from CGI to PHP-FPM. PHP-FPM is more performant and not affected by this vulnerability class. This is the recommended long-term fix for all Windows PHP production deployments.

The Deeper Lesson

CVE-2024-4577 teaches a critical lesson about security patch design: you must account for all transformations that input undergoes, not just the value at the moment of validation. PHP’s 2012 fix checked one byte value (0x2D) without considering that Windows could transform a different byte into that value. Twelve years passed before anyone thought to look for this gap.

Conclusion

CVE-2024-4577 is a masterclass in creative vulnerability research and a stark reminder that “patched” does not mean “permanently fixed.” If you run PHP on Windows — especially XAMPP — patch now and audit your logs. For professional web application security assessments, contact Vivek Verma for a VAPT engagement.