CVE-2024-1874 — AI Deep Analysis Summary

🚨 **Essence**: PHP `proc_open()` command injection due to insufficient escaping. 📉 **Consequences**: Attackers can execute arbitrary commands on Windows shells.…

🛡️ **Root Cause**: CWE-116 (Improper Encoding/Escaping). 🐛 **Flaw**: When using array syntax in `proc_open()`, input validation fails if the command name has trailing spaces, bypassing previous fixes.

📦 **Affected**: PHP Group products. 📅 **Versions**: 8.1.* (before 8.1.29), 8.2.* (before 8.2.20), 8.3.* (before 8.3.8). ⚠️ **Note**: Older patches were bypassable via trailing spaces.

👑 **Privileges**: System-level access (User context of the PHP process). 📂 **Data**: Full read/write access to server files, databases, and environment variables. 🖥️ **Action**: Arbitrary command execution on Windows.

🔓 **Threshold**: LOW. 🌐 **Auth**: None required (CVSS PR:N). 🎯 **Config**: Requires `proc_open()` usage with user-controlled array inputs. 🚀 **Exploitability**: High (AV:N, AC:L).

💣 **Public Exp**: YES. 📂 **PoCs**: Available on GitHub (e.g., ox1111, Tgcohce). 🔍 **Status**: Active exploitation techniques documented, specifically targeting the trailing space bypass.

🔍 **Check**: Scan for `proc_open()` calls with dynamic array inputs. 📊 **Tooling**: Use SAST/DAST tools detecting CWE-116. 🐘 **Version**: Verify PHP version against the affected list (8.1-8.3 pre-patch versions).

✅ **Fixed**: YES. 🔄 **Patch**: Upgrade to PHP 8.1.29+, 8.2.20+, or 8.3.8+. 🛡️ **Vendor**: PHP Group released security advisories (GHSA-pc52-254m-w9w7).

🚧 **Workaround**: Avoid `proc_open()` with user-controlled arrays. 🛑 **Mitigation**: Strict input validation/sanitization. 🚫 **Alternative**: Use safer functions like `exec()` with strict whitelisting if possible.

🔥 **Priority**: CRITICAL. 🚨 **Urgency**: HIGH. 📢 **Action**: Immediate patching required. 📉 **Risk**: Remote Code Execution (RCE) with no authentication needed.