# Critical RCE vulnerability in PHP CGI: everything you need to know

Windows PHP-CGI Best-Fit encoding conversion lets unauthenticated attackers inject CLI arguments via crafted query strings, achieving RCE; TellYouThePass ransomware exploited it.

- Payout: Real-world hack
- Severity: critical
- Program: PHP
- Found by (vendor credit): Orange Tsai, DEVCORE Research Team
- Analysis by: Wiz Research
- Disclosed: 2024-06-10
- CVE: CVE-2024-4577
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/critical-rce-php-cgi-vulnerability
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-critical-rce-php-cgi-vulnerability
- Tags: area:web domain:web impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:php tech:windows technique:incomplete-fix technique:unicode-normalization vuln:command-injection vuln:rce

**Target:** PHP CGI binary on Windows (Apache CGI mode, XAMPP)
**Root cause:** Windows Best-Fit encoding conversion maps certain multibyte character sequences to characters like '-' that PHP's CGI argument handling treats as CLI options, bypassing the CVE-2012-1823 fix.
**Steps:**
1. Target a Windows host running PHP in CGI mode or exposing php-cgi (e.g. default XAMPP).
2. Send a request whose query string contains a Best-Fit-mapped character sequence (e.g. `%ad`) that converts to a `-` argument prefix.
3. Append php-cgi options such as `-d allow_url_include=1 -d auto_prepend_file=php://input` to inject and execute PHP code.
4. Observe arbitrary code execution as the web server user.
**How found:** Devcore identified that Windows Best-Fit encoding conversion could transform attacker-supplied multibyte sequences into characters interpreted as CLI argument separators, reviving the CVE-2012-1823 argument-injection primitive.
**Exploitation:** TellYouThePass used public exploit code to run arbitrary PHP, then invoked mshta.exe to execute an HTA with VBScript containing a base64 string that decodes to a .NET ransomware binary loaded into memory; it beacons via an HTTP request disguised as a CSS fetch and encrypts files, leaving READ_ME10.html demanding 0.1 BTC.
**Escalation:** RCE used as initial access to deploy in-memory .NET ransomware across multiple victim websites.
**Insight:** When a prior argument-injection fix blacklists characters, check OS-level encoding/locale conversion layers (Windows Best-Fit, codepages) that can synthesize those characters from innocuous multibyte input; test Chinese/Japanese locales specifically.