PHP CGI Flaw Exploited for Webshells in Japan
Attackers are exploiting CVE-2024-4577, a PHP remote code execution flaw on Windows, to plant webshells on Japanese organizations' web servers.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2023-29300 and CVE-2024-4577 as exploited in the wild.
IPA has confirmed active exploitation of CVE-2024-4577, a remote code execution vulnerability in PHP-CGI on Windows, against multiple organizations in Japan. Attackers exploited the flaw to install webshells on affected web services, which the agency warns could be used both for direct network intrusion and as relay points (ORBs, Operational Relay Boxes) to obscure attacker infrastructure or proxy further attacks against other targets.
The advisory situates this activity within a broader trend of 'network-penetrating attacks' targeting internet-facing devices such as VPN appliances, security gateways, and servers at the network perimeter. IPA draws parallels to the Volt Typhoon campaign, which compromised network devices to establish long-term, living-off-the-land persistence against critical infrastructure in the US and allied nations, and to a prior APT campaign against TP-Link routers that similarly converted victim devices into ORB nodes.
CVE-2024-4577 is listed in CISA's Known Exploited Vulnerabilities catalog and affects PHP versions running on Windows, including the 5.x, 7.x, and 8.0.x branches which are now end-of-life. IPA urges all PHP users to apply patches immediately, upgrade unsupported versions, and review network logs for signs of webshell activity or ORB-related traffic even if patches have already been applied.
Mentioned in this report
Detection guidance
Webshell File Creation on Web Server
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of webshell files (suspicious extensions or naming) in web-accessible directories on Windows systems. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Webshell File Creation on Web Server
description: Detects file creation events in web root directories (htdocs, www, inetpub)
with suspicious naming patterns or dual extensions typical of webshell deployment
post-exploitation. Targets the distinctive behaviour of webshell placement in publicly-accessible
paths.
tags:
- attack.t1505.003
- attack.persistence
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \htdocs\
- \www\
- \inetpub\
TargetFilename|endswith:
- .php
- .php5
- .phtml
- .phar
TargetFilename|re: \.(php|asp|aspx)\.(jpg|txt|gif|png)$
filter_updates:
TargetFilename|contains:
- wp-content
- plugins
- updates
condition: selection and not filter_updates
falsepositives:
- Legitimate web application updates or CMS plugin installation
- Developer testing of PHP files in local web roots
level: medium
id: cda7a15c-fb97-5408-a6c3-69991944c479
status: experimental
author: Vorant
PHP-CGI Process Execution with Argument Injection
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects php-cgi.exe process spawning with command-line arguments indicative of code injection (-r, -d, allow_url_include). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP-CGI Process Execution with Argument Injection
description: Detects php-cgi.exe or php.exe spawning with command-line flags (-r,
-d, allow_url_include, auto_prepend_file) that enable remote code execution, typical
of CVE-2024-4577 exploitation chains on Windows.
tags:
- attack.t1190
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \php-cgi.exe
- \php.exe
CommandLine|contains:
- ' -r '
- ' -d '
- allow_url_include
- auto_prepend_file
filter_legitimate:
ParentImage|contains:
- apache
- nginx
- iis
CommandLine|contains: version
condition: selection and not filter_legitimate
falsepositives:
- Web server daemon spawning PHP-CGI with -d flag for legitimate config overrides
- PHP CLI administrative scripts using -r for one-liners
level: high
id: e078a126-2168-5dc3-9361-fb9dce1f67a9
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert_20240705.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs, actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs