Arbitrary File Inclusion in PHP 8.18.3 via cgi.force_redirect
CVE-2024-8927 Published on October 8, 2024
cgi.force_redirect configuration is bypassable due to the environment variable collision
In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.
Vulnerability Analysis
CVE-2024-8927 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Products Associated with CVE-2024-8927
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-8927 are published in these products:
Affected Versions
PHP Group PHP:- Version 8.1.* and below 8.1.30 is affected.
- Version 8.2.* and below 8.2.24 is affected.
- Version 8.3.* and below 8.3.12 is affected.
- Version 8.1.0 and below 8.1.30 is affected.
- Version 8.2.0 and below 8.2.24 is affected.
- Version 8.3.0 and below 8.3.12 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.