PHP CVE-2024-4577 exploited to deploy webshells in Japan

4 July 2024 high threat infrastructure

IPA warns of active exploitation of PHP CVE-2024-4577 in Japan, with webshells deployed at multiple organizations and potential ORB weaponization by APT groups.

Japan's IPA has confirmed active exploitation of CVE-2024-4577, a remote code execution vulnerability in PHP, affecting multiple domestic organizations. Attackers have successfully deployed webshells on vulnerable web services running PHP on Windows systems. The advisory emphasizes the risk of network-penetration attacks targeting internet-facing devices and the potential for compromised systems to be weaponized as Operational Relay Boxes (ORBs) for further attacks against other organizations or to relay C2 communications. IPA draws parallels to the Volt Typhoon campaign targeting critical infrastructure and previous APT campaigns exploiting TP-Link routers in Japan. The vulnerability is listed in CISA's KEV catalog and shows high EPSS scores indicating significant exploitation probability. Organizations are urged to patch immediately and review logs for indicators of compromise, even if already patched, to detect potential ORB activity.

Mentioned in this report

Vulnerabilities CVE-2023-29300KEVCVE-2024-4577KEV

Threat actors Volt Typhoon

Campaigns Volt Typhoon

Detection guidance

Suspicious Child Process Spawned by PHP CGI (CVE-2024-4577 Exploitation)

ATT&CK T1190

Detects php-cgi.exe or php.exe spawning command interpreters, indicating likely exploitation of the PHP CGI argument-injection RCE (CVE-2024-4577) used to deploy webshells. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PHP CGI Spawning Command Shell
id: e3cd4aff-5dcc-5f36-a5b6-752e85b2847b
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \\php-cgi.exe
    - \\php.exe
  selection_child:
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\powershell_ise.exe
    - \\cscript.exe
    - \\wscript.exe
    - \\wmic.exe
    - \\mshta.exe
    - \\rundll32.exe
  condition: selection_parent and selection_child
falsepositives:
- Legitimate PHP applications that intentionally shell out for administrative or build
  tasks (rare in production web servers)
- Custom PHP-based CI/CD tooling running on IIS/Apache with PHP CGI
level: high
tags:
- attack.t1190
- attack.t1588.006
author: Vorant

PHP CGI Argument Injection Command Line Pattern (CVE-2024-4577)

ATT&CK T1190

Detects the distinctive PHP-CGI command-line argument injection pattern used to exploit CVE-2024-4577, where attacker-controlled query strings are passed as php.ini directive overrides (e.g. allow_url_include, auto_prepend_file=php://input) to achieve remote code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: PHP CGI Argument Injection Exploit Pattern
id: eaccab52-829e-50c8-a0d7-613f77c25afb
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \\php-cgi.exe
    - \\php.exe
    CommandLine|contains:
    - -d allow_url_include
    - -d auto_prepend_file
    - php://input
    - -d cgi.force_redirect
    - -d disable_functions
  condition: selection
falsepositives:
- Legitimate administrators tuning php.ini directives via command line for debugging
  (uncommon in production)
level: high
tags:
- attack.t1190
- attack.t1588.006
author: Vorant

Webshell File Dropped by Web Server or PHP Worker Process

ATT&CK T1505.003

Detects creation of script files (php/asp/aspx/jsp) by IIS, Apache, or PHP CGI worker processes in web-accessible directories, consistent with webshell deployment following exploitation of a web application vulnerability such as CVE-2024-4577. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Webshell Dropped by Web Server Process
id: 14ef012e-53ed-5dac-a885-6ba191e15505
status: experimental
logsource:
  category: file_event
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \\php-cgi.exe
    - \\php.exe
    - \\w3wp.exe
    - \\httpd.exe
    - \\apache.exe
  selection_target:
    TargetFilename|endswith:
    - .php
    - .phtml
    - .asp
    - .aspx
    - .jsp
  filter_common:
    TargetFilename|contains:
    - \\wp-content\\uploads\\
  condition: selection_process and selection_target and not filter_common
falsepositives:
- Legitimate deployment or update of PHP/ASP application files by developers or CI/CD
  pipelines
- CMS plugin/theme updates writing new script files during normal operation
level: medium
tags:
- attack.t1505.003
- attack.t1190
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2024/alert_20240705.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free