CVE-2024-5585

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-5585
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.

7.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/06/07/1 Mailing List Third Party Advisory
https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385 Exploit Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
https://security.netapp.com/advisory/ntap-20240726-0002/
http://www.openwall.com/lists/oss-security/2024/06/07/1 Mailing List Third Party Advisory
https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385 Exploit Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/
https://security.netapp.com/advisory/ntap-20240726-0002/
https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:a:php:php:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
History

21 Nov 2024, 09:47

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.8 		v2 : unknown
v3 : 7.7
References
  • () https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585 -
References () http://www.openwall.com/lists/oss-security/2024/06/07/1 - Mailing List, Third Party Advisory () http://www.openwall.com/lists/oss-security/2024/06/07/1 - Mailing List, Third Party Advisory
References () https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385 - Exploit, Third Party Advisory () https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385 - Exploit, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ - Third Party Advisory () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ - Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ -
References () https://security.netapp.com/advisory/ntap-20240726-0002/ - () https://security.netapp.com/advisory/ntap-20240726-0002/ -

28 Jul 2024, 14:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240726-0002/ -

13 Jun 2024, 04:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/ -

12 Jun 2024, 17:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 7.7 		v2 : unknown
v3 : 8.8
References () http://www.openwall.com/lists/oss-security/2024/06/07/1 - () http://www.openwall.com/lists/oss-security/2024/06/07/1 - Mailing List, Third Party Advisory
References () https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385 - () https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385 - Exploit, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ - Third Party Advisory
First Time Php
Fedoraproject
Php php
Fedoraproject fedora
CPE cpe:2.3:a:php:php:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*

12 Jun 2024, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/ -

10 Jun 2024, 17:16

Type Values Removed Values Added
Summary
  • (es) En las versiones de PHP 8.1.* anteriores a 8.1.29, 8.2.* anteriores a 8.2.20, 8.3.* anteriores a 8.3.8, la solución para CVE-2024-1874 no funciona si el nombre del comando incluye espacios finales. Problema original: cuando se utiliza el comando proc_open() con sintaxis de matriz, debido a un escape insuficiente, si los argumentos del comando ejecutado están controlados por un usuario malintencionado, el usuario puede proporcionar argumentos que ejecutarían comandos arbitrarios en el shell de Windows.
References
  • () http://www.openwall.com/lists/oss-security/2024/06/07/1 -

09 Jun 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-09 19:15

Updated : 2024-11-21 09:47

NVD link : CVE-2024-5585

Mitre link : CVE-2024-5585

CVE.ORG link : CVE-2024-5585

JSON object : View

Products Affected

php

  • php

fedoraproject

  • fedora
CWE
CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-116

Improper Encoding or Escaping of Output