CVE-2024-5585
published 2024-06-09CVE-2024-5585: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing…
PriorityP271high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
28.81%
97.9th percentile
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | php7.4 | — | — |
| debian | php8.2 | — | — |
| fedoraproject | fedora | — | — |
| msrc | azl3_php_8.3.6-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_php_8.3.8-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_php_8.1.28-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_php_8.1.29-1_on_cbl_mariner_2.0 | — | — |
| php | php | >= 8.1.0 < 8.1.29 | 8.1.29 |
| php | php | >= 8.2.0 < 8.2.20 | 8.2.20 |
| php | php | >= 8.3.0 < 8.3.8 | 8.3.8 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for proc_open() calls using array syntax where command name includes trailing spaces, which bypasses the CVE-2024-1874 fix and may allow argument injection leading to arbitrary command execution in Windows shell. ↗
- →Flag PHP applications running on Windows that invoke proc_open() with array-syntax command parameters, particularly where user-controlled input is passed as arguments — the bypass vector is a trailing space appended to the command name. ↗
- ·Vulnerability is Windows-specific (Windows shell argument escaping issue); Linux/Debian scope is listed as 'local' and Debian bullseye is marked resolved. Red Hat states no RHEL products are affected. ↗
- ·Affected PHP versions are 8.1.* before 8.1.29, 8.2.* before 8.2.20, and 8.3.* before 8.3.8. Instances running these versions on Windows are the primary risk surface. ↗
- ·No Red Hat products are affected by this CVE across RHEL 6 through 10 and all php module streams. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_debian9.4LOW
vendor_redhat9.4CRITICAL
vendor_msrc8.8HIGH
vendor_oracle8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (PHP) — CVE-2024-5585
vendor_oracle·2024-10-15·CVSS 8.8
CVE-2024-5585 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Core (PHP) — CVE-2024-5585
Oracle Oracle Communications Applications Risk Matrix: Core (PHP) vulnerability
CVE: CVE-2024-5585
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2024 (OCT 2024)
Microsoft
Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)
vendor_msrc·2024-06-11·CVSS 8.8
CVE-2024-5585 [CRITICAL] CWE-116 Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)
Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner R
Red Hat
php: Arguments execute arbitrary commands in Windows shell
vendor_redhat·2024-06-07·CVSS 9.4
CVE-2024-5585 [CRITICAL] CWE-78 php: Arguments execute arbitrary commands in Windows shell
php: Arguments execute arbitrary commands in Windows shell
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
In PHP, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute
Debian
CVE-2024-5585: php7.4 - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, th...
vendor_debian·2024·CVSS 9.4
CVE-2024-5585 [CRITICAL] CVE-2024-5585: php7.4 - In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, th...
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.
Scope: local
bullseye: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2024/06/07/1https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385https://lists.fedoraproject.org/archives/list/[email protected]/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/https://lists.fedoraproject.org/archives/list/[email protected]/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/https://security.netapp.com/advisory/ntap-20240726-0002/http://www.openwall.com/lists/oss-security/2024/06/07/1https://github.com/php/php-src/security/advisories/GHSA-9fcc-425m-g385https://lists.fedoraproject.org/archives/list/[email protected]/message/PKGTQUOA2NTZ3RXN22CSAUJPIRUYRB4B/https://lists.fedoraproject.org/archives/list/[email protected]/message/W45DBOH56NQDRTOM2DN2LNA2FZIMC3PK/https://security.netapp.com/advisory/ntap-20240726-0002/https://www.vicarius.io/vsociety/posts/command-injection-vulnerability-in-php-on-windows-systems-cve-2024-1874-and-cve-2024-5585
2024-06-09
Published