PHP CVE-2024-4577 exploited for webshell deployment in Japan

4 July 2024 high threat infrastructure

Japan's IPA confirms multiple domestic organizations compromised via CVE-2024-4577 PHP vulnerability, with webshells deployed for network penetration and potential ORB infrastructure.

Japan's Information-technology Promotion Agency (IPA) has confirmed active exploitation of CVE-2024-4577, a remote code execution vulnerability in PHP, affecting multiple Japanese organizations. Attackers deployed webshells on vulnerable PHP-based web services, establishing footholds for network penetration attacks. The vulnerability targets PHP installations running on Windows in CGI mode and has been added to CISA's Known Exploited Vulnerabilities catalog.

IPA warns that compromised systems are being weaponized as Operational Relay Boxes (ORBs) to relay C2 communications, obscure attack origins, and serve as staging infrastructure for attacks against other organizations. This activity mirrors the Volt Typhoon campaign tactics observed against critical infrastructure in Western nations. IPA notes that APT groups have previously targeted Japan with similar ORB-creation campaigns, including exploitation of TP-Link routers.

The advisory emphasizes that network boundary devices—VPN appliances, security products, and internet-facing servers—remain primary targets for these network-penetration attacks. Organizations using affected PHP versions are urged to apply patches immediately and review communications logs for indicators of compromise or ORB activity, even if already patched.

Mentioned in this report

Vulnerabilities CVE-2023-29300KEVCVE-2024-4577KEV

Threat actors Volt Typhoon

Campaigns Volt Typhoon

Detection guidance

Suspicious Child Process Spawned by PHP-CGI (CVE-2024-4577 Exploitation)

ATT&CK T1190

Detects command execution originating from php-cgi.exe or php.exe, consistent with exploitation of CVE-2024-4577 argument injection RCE leading to webshell deployment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Child Process Spawned by PHP-CGI
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \php-cgi.exe
    - \php.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \mshta.exe
    - \certutil.exe
    - \rundll32.exe
    - \net.exe
    - \whoami.exe
    - \systeminfo.exe
    - \ipconfig.exe
  filter:
    CommandLine|contains:
    - -v
    - --version
  condition: selection and not filter
falsepositives:
- Legitimate PHP application logic that shells out to system utilities (rare in production,
  should be verified)
- Administrative diagnostic scripts intentionally invoking PHP CLI tools
level: high
tags:
- attack.t1190
- attack.t1505.003
id: 0a70db98-8701-5feb-8afd-bd955bac0c3b
status: experimental
author: Vorant

Webshell File Written to Web Root by Web Server Process

ATT&CK T1505.003

Detects creation of script files with webshell-like extensions in typical IIS/Apache web root directories by a web server or PHP CGI process, indicative of webshell drop following exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Webshell File Written by Web Server Process
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \php-cgi.exe
    - \php.exe
    - \httpd.exe
    - \w3wp.exe
    TargetFilename|contains:
    - \wwwroot\
    - \htdocs\
    - \www\
    TargetFilename|endswith:
    - .php
    - .phtml
    - .asp
    - .aspx
    - .jsp
  condition: selection
falsepositives:
- Legitimate deployment or update of web application files by CI/CD pipelines or developers
- Content management system plugin/theme updates writing new script files
level: high
tags:
- attack.t1505.003
- attack.t1190
id: dc457d71-c1f4-5359-b777-f59204087345
status: experimental
author: Vorant

Outbound Connection from Web Server Process to Uncommon External Port (Possible ORB/Proxy Relay)

ATT&CK T1090

Detects a web server or PHP process establishing outbound network connections to non-standard high ports, consistent with compromised hosts being used as Operational Relay Boxes to proxy C2 traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Outbound Connection to Uncommon Port
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \php-cgi.exe
    - \php.exe
    - \httpd.exe
    - \w3wp.exe
    Initiated: true
  filter_common:
    DestinationPort:
    - 80
    - 443
    - 8080
  condition: selection and not filter_common
falsepositives:
- Web applications with legitimate outbound integrations (e.g., payment gateways,
  APIs) on non-standard ports
- Health-check or monitoring agents embedded in the web server process
level: medium
tags:
- attack.t1090
- attack.t1190
id: 49448bee-bbde-51ef-b11e-93d3fd149c9a
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert_20240705.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free