PHP CGI Flaw Exploited for Webshells in Japan
Attackers are exploiting CVE-2024-4577, a PHP remote code execution flaw on Windows, to plant webshells on Japanese organizations' web servers.
IPA has confirmed active exploitation of CVE-2024-4577, a remote code execution vulnerability in PHP-CGI on Windows, against multiple organizations in Japan. Attackers exploited the flaw to install webshells on affected web services, which the agency warns could be used both for direct network intrusion and as relay points (ORBs, Operational Relay Boxes) to obscure attacker infrastructure or proxy further attacks against other targets.
The advisory situates this activity within a broader trend of 'network-penetrating attacks' targeting internet-facing devices such as VPN appliances, security gateways, and servers at the network perimeter. IPA draws parallels to the Volt Typhoon campaign, which compromised network devices to establish long-term, living-off-the-land persistence against critical infrastructure in the US and allied nations, and to a prior APT campaign against TP-Link routers that similarly converted victim devices into ORB nodes.
CVE-2024-4577 is listed in CISA's Known Exploited Vulnerabilities catalog and affects PHP versions running on Windows, including the 5.x, 7.x, and 8.0.x branches which are now end-of-life. IPA urges all PHP users to apply patches immediately, upgrade unsupported versions, and review network logs for signs of webshell activity or ORB-related traffic even if patches have already been applied.
Mentioned in this report
Detection guidance
PHP-CGI Remote Code Execution Exploitation Attempt
Detects HTTP requests to PHP-CGI with suspicious query string patterns typical of CVE-2024-4577 exploitation (e.g., -r, -d flags in URL parameters). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP-CGI Remote Code Execution Exploitation Attempt
description: Detects HTTP requests to PHP-CGI endpoints containing command-line argument
injection patterns (-r, -d, -a flags) characteristic of CVE-2024-4577 exploitation
on Windows. Generalises on the flag pattern in query strings rather than specific
payloads.
tags:
- attack.t1190
- attack.initial-access
logsource:
category: proxy
product: generic
detection:
selection:
uri|contains:
- .php?
- .php/
query_string|re: (-r|-d|-a|allow_url_include|auto_prepend_file)
filter_legitimate:
query_string|contains:
- PHPSESSID
- utm_
condition: selection and not filter_legitimate
falsepositives:
- Legitimate PHP parameter passing with flags in query strings
- Web scanning tools probing PHP endpoints with command-line patterns
level: high
id: 25c94f08-943a-59f5-801d-acea834b237e
status: experimental
author: Vorant
Webshell File Creation on Web Server
Detects creation of webshell files (suspicious extensions or naming) in web-accessible directories on Windows systems. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Webshell File Creation on Web Server
description: Detects file creation events in web root directories (htdocs, www, inetpub)
with suspicious naming patterns or dual extensions typical of webshell deployment
post-exploitation. Targets the distinctive behaviour of webshell placement in publicly-accessible
paths.
tags:
- attack.t1505.003
- attack.persistence
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \htdocs\
- \www\
- \inetpub\
TargetFilename|endswith:
- .php
- .php5
- .phtml
- .phar
TargetFilename|re: \.(php|asp|aspx)\.(jpg|txt|gif|png)$
filter_updates:
TargetFilename|contains:
- wp-content
- plugins
- updates
condition: selection and not filter_updates
falsepositives:
- Legitimate web application updates or CMS plugin installation
- Developer testing of PHP files in local web roots
level: medium
id: cda7a15c-fb97-5408-a6c3-69991944c479
status: experimental
author: Vorant
PHP-CGI Process Execution with Argument Injection
Detects php-cgi.exe process spawning with command-line arguments indicative of code injection (-r, -d, allow_url_include). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP-CGI Process Execution with Argument Injection
description: Detects php-cgi.exe or php.exe spawning with command-line flags (-r,
-d, allow_url_include, auto_prepend_file) that enable remote code execution, typical
of CVE-2024-4577 exploitation chains on Windows.
tags:
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \php-cgi.exe
- \php.exe
CommandLine|contains:
- ' -r '
- ' -d '
- allow_url_include
- auto_prepend_file
filter_legitimate:
ParentImage|contains:
- apache
- nginx
- iis
CommandLine|contains: version
condition: selection and not filter_legitimate
falsepositives:
- Web server daemon spawning PHP-CGI with -d flag for legitimate config overrides
- PHP CLI administrative scripts using -r for one-liners
level: high
id: e078a126-2168-5dc3-9361-fb9dce1f67a9
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert_20240705.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free