# CVE-2024-4577 — PHP CGI Argument Injection Indicators of Compromise
# Generated by Lyrie Threat Intelligence (lyrie.ai/research)
# Date: 2026-04-25

## HTTP Request Signatures

# Best-Fit character exploitation
%AD  (soft hyphen, 0xAD)
%ad
\xC2\xAD  (UTF-8 encoded)

# PHP argument injection patterns
%ADd (converts to -d)
%ADn (converts to -n)
%ADc (converts to -c)

# Full exploit patterns
%ADd+allow_url_include%3D1
%ADd+auto_prepend_file%3Dhttp://
%ADd+auto_append_file%3Dhttp://
%ADd+disable_functions%3D
%ADd+open_basedir%3D
%ADn+  (no php.ini)

## URL-Encoded Variations

%ADd%20allow_url_include
%ADd%09allow_url_include  (tab separator)
%ADd%0Aallow_url_include  (newline separator)

## Dangerous PHP Directives (when combined with %AD)

allow_url_include=1
auto_prepend_file=http://
auto_append_file=http://
disable_functions=""
open_basedir="/"

## Remote File Patterns

http://attacker.com/shell.txt
https://attacker.com/webshell.php
http://[IP]/backdoor.txt
data://text/plain;base64,

## User-Agent Patterns (common exploit tools)

curl/
python-requests/
python-urllib/
Wget/
Nuclei

## Behavioral Indicators

# Multiple requests with %AD to same server
# Requests to .php files with %AD in query string
# HTTP 200 responses followed by unusual PHP execution
# Outbound connections from web server after %AD request

## Detection Queries

# Apache/Nginx logs
grep -E '%AD|%ad|\\xC2\\xAD' /var/log/apache2/access.log
grep -E '%ADd|%ADn|%ADc' /var/log/nginx/access.log

# Splunk
index=web sourcetype=access_combined uri_query="*%AD*"
index=web sourcetype=access_combined uri_query="*allow_url_include*" uri_query="*%AD*"

# Elastic/OpenSearch
http.request.uri: "*%AD*" AND http.request.uri: ("*allow_url_include*" OR "*auto_prepend_file*")

# ModSecurity/WAF rule
SecRule ARGS "@rx (?i)%ad[dnc]" "id:1001,phase:2,block,msg:'CVE-2024-4577 PHP CGI injection'"

## File System Indicators

# Dropped webshells
/tmp/shell.php
/var/tmp/backdoor.php
/tmp/*.txt (included via auto_prepend_file)

# PHP error logs showing argument injection
/var/log/php-fpm/error.log
/var/log/php/error.log

## Network Indicators

# Outbound HTTP from web server (fetching remote includes)
# Reverse shell connections from web server
# Large POST requests to .php files after %AD exploitation

## Mitigation Verification

# Check PHP version (patched = 8.3.8+, 8.2.20+, 8.1.29+)
php -v

# Verify CGI mode disabled or upgraded
php-cgi -v

# Check for %AD blocks in WAF logs
# Verify mod_php or PHP-FPM in use (not CGI)
