[Feature Request] Add Vuln Module for PHP CGI Argument Injection (CVE-2024-4577)

[ayush-codes6439]

Summary

Proposing a new vulnerability detection module for CVE-2024-4577 (PHP CGI Argument Injection), a critical unauthenticated Remote Code Execution flaw listed in the CISA KEV catalog.

Vulnerability Details

• CVE ID: CVE-2024-4577
• Severity: Critical (CVSS 9.8) - CISA KEV Listed
• Target: PHP running in CGI mode on Windows systems.
• Detection Rationale: Sends a crafted HTTP request with specific query string arguments (e.g., %ad-d+allow_url_include%3d1) to check if the target PHP interpreter parses CGI options inappropriately.
• False Positive Mitigation: Validates specific HTTP response status codes and expected response body patterns to prevent false positives.

Coverage Verification

• Verified that no existing module covers CVE-2024-4577 under nettacker/modules/vuln.
• Verified there are no open/closed PRs or issues regarding this CVE.

I would like to work on this and submit the YAML detection module. Could you please review and assign this issue to me? @securestep9 @arkid15r

[ayush-codes6439]

Hi @fthsrbst @securestep9 @arkid15r,

As I opened this feature request and explicitly asked to be assigned to work on it, I have already prepared the YAML module for CVE-2024-4577 and am getting ready to submit my PR.

According to standard open-source contribution ethics and repository guidelines, please allow me to submit my PR for this issue since I requested the assignment first. I will link my PR shortly.

Thanks!

[fthsrbst]

Hi @ayush-codes6439,
My apologies for the misunderstanding! I didn't realize you had already claimed the issue when you opened it. I've deleted my comment/PR so you can proceed.
Please go ahead with your PR. Good luck!

[ayush-codes6439]

Hi @securestep9 @arkid15r,

I created the PR #1693 with the complete YAML detection module for CVE-2024-4577, but the automated github-actions bot closed it because issue #1687 is not assigned to me yet.

Could you please assign this issue (#1687) to me so I can reopen the PR and pass the contribution validator?

Thanks!