CVE-2024-4577 Exploits in the Wild One Day After Disclosure

Date: 07/13/2024

Severity: Medium

Summary

The Akamai Security Intelligence Response Team (SIRT) is monitoring CVE-2024-4577, a PHP vulnerability disclosed in June 2024 that affects CGI mode installations. While it primarily impacts Windows systems with Chinese and Japanese locales, it may extend to other configurations. Following the disclosure, SIRT observed swift exploit attempts, including command injection and campaigns like Gh0st RAT and RedTail cryptominers, with Akamai App & API Protector working to mitigate these threats.

Indicators of Compromise (IOC) List

URL/Domain

p.findmeatthe.top

p.deutschland-zahlung.eu

p.shadow-mods.net

IP Address

147.50.253.109

146.19.100.7

23.237.182.122

147.50.253.220

147.50.253.222

147.50.253.225

147.50.253.219

147.50.253.231

147.50.253.99

147.50.253.100

147.50.253.228

147.50.253.5

147.50.253.4

154.197.12..156

147.50.253.110

147.50.253.102

147.50.253.218

147.50.253.23

147.50.253.11

147.50.253.163

147.50.253.2

147.50.253.116

147.50.253.18

147.50.253.109

147.50.253.106

147.50.253.112

147.50.253.111

147.50.253.7

147.50.253.104

147.50.253.167

147.50.253.119

147.50.253.113

147.50.253.103

147.50.253.107

147.50.253.105

147.50.253.114

147.50.253.108

147.50.253.101

147.50.253.117

147.50.253.115

147.50.229.12

185.172.128.93

147.139.29.220

86.48.2.49

185.201.8.176

194.59.165.52

156.67.218.115

Hash

A646ebf85afa29ae1c77458c575b5e4b0b145d813db028435d33b522edccdc0e

2c602147c727621c5e98525466b8ea78832abe2c3de10f0b33ce9a4adea205eb

0d70a044732a77957eaaf28d9574d75da54ae430d8ad2e4049bd182e13967a6f

ab897157fdef11b267e986ef286fd44a699e3699a458d90994e020619653d2cd

9753df3ea4b9948c82310f64ff103685f78af85e3e08bb5f0d0d44047c63c315

19a06de9a8b66196fa6cc9e86824dee577e462cbeaf36d715c8fea5bcb08b54d

1ae2fef05798f0f27e9de76fcef0217f282090fab1ba750623ca36b413151434

9e28f942262805b5fb59f46568fed53fd4b7dbf6faf666bedaf6ff22dd416572

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

URL/Domain	userdomainname IN ("p.deutschland-zahlung.eu","p.findmeatthe.top","p.shadow-mods.net") or url IN ("p.deutschland-zahlung.eu","p.findmeatthe.top","p.shadow-mods.net")
IP Address	dstipaddress IN ("147.50.253.5","185.201.8.176","147.50.253.113","147.50.253.101","147.50.253.107","147.50.253.109","147.50.253.114","147.50.253.219","147.50.253.163","147.139.29.220","147.50.253.225","147.50.253.222","147.50.253.2","147.50.253.228","146.19.100.7","147.50.253.220","147.50.253.218","147.50.253.102","147.50.253.111","147.50.253.99","147.50.253.4","147.50.253.7","147.50.253.108","147.50.229.12","147.50.253.104","147.50.253.231","147.50.253.100","147.50.253.106","147.50.253.23","147.50.253.103","86.48.2.49","147.50.253.110","147.50.253.119","147.50.253.115","147.50.253.117","23.237.182.122","147.50.253.112","156.67.218.115","147.50.253.11","147.50.253.167","147.50.253.116","147.50.253.105","194.59.165.52","185.172.128.93") or ipaddress IN ("147.50.253.5","185.201.8.176","147.50.253.113","147.50.253.101","147.50.253.107","147.50.253.109","147.50.253.114","147.50.253.219","147.50.253.163","147.139.29.220","147.50.253.225","147.50.253.222","147.50.253.2","147.50.253.228","146.19.100.7","147.50.253.220","147.50.253.218","147.50.253.102","147.50.253.111","147.50.253.99","147.50.253.4","147.50.253.7","147.50.253.108","147.50.229.12","147.50.253.104","147.50.253.231","147.50.253.100","147.50.253.106","147.50.253.23","147.50.253.103","86.48.2.49","147.50.253.110","147.50.253.119","147.50.253.115","147.50.253.117","23.237.182.122","147.50.253.112","156.67.218.115","147.50.253.11","147.50.253.167","147.50.253.116","147.50.253.105","194.59.165.52","185.172.128.93") or publicipaddress IN ("147.50.253.5","185.201.8.176","147.50.253.113","147.50.253.101","147.50.253.107","147.50.253.109","147.50.253.114","147.50.253.219","147.50.253.163","147.139.29.220","147.50.253.225","147.50.253.222","147.50.253.2","147.50.253.228","146.19.100.7","147.50.253.220","147.50.253.218","147.50.253.102","147.50.253.111","147.50.253.99","147.50.253.4","147.50.253.7","147.50.253.108","147.50.229.12","147.50.253.104","147.50.253.231","147.50.253.100","147.50.253.106","147.50.253.23","147.50.253.103","86.48.2.49","147.50.253.110","147.50.253.119","147.50.253.115","147.50.253.117","23.237.182.122","147.50.253.112","156.67.218.115","147.50.253.11","147.50.253.167","147.50.253.116","147.50.253.105","194.59.165.52","185.172.128.93") or srcipaddress IN ("147.50.253.5","185.201.8.176","147.50.253.113","147.50.253.101","147.50.253.107","147.50.253.109","147.50.253.114","147.50.253.219","147.50.253.163","147.139.29.220","147.50.253.225","147.50.253.222","147.50.253.2","147.50.253.228","146.19.100.7","147.50.253.220","147.50.253.218","147.50.253.102","147.50.253.111","147.50.253.99","147.50.253.4","147.50.253.7","147.50.253.108","147.50.229.12","147.50.253.104","147.50.253.231","147.50.253.100","147.50.253.106","147.50.253.23","147.50.253.103","86.48.2.49","147.50.253.110","147.50.253.119","147.50.253.115","147.50.253.117","23.237.182.122","147.50.253.112","156.67.218.115","147.50.253.11","147.50.253.167","147.50.253.116","147.50.253.105","194.59.165.52","185.172.128.93")
Hash	sha256hash IN ("9e28f942262805b5fb59f46568fed53fd4b7dbf6faf666bedaf6ff22dd416572","9753df3ea4b9948c82310f64ff103685f78af85e3e08bb5f0d0d44047c63c315","A646ebf85afa29ae1c77458c575b5e4b0b145d813db028435d33b522edccdc0e","ab897157fdef11b267e986ef286fd44a699e3699a458d90994e020619653d2cd","0d70a044732a77957eaaf28d9574d75da54ae430d8ad2e4049bd182e13967a6f","2c602147c727621c5e98525466b8ea78832abe2c3de10f0b33ce9a4adea205eb","19a06de9a8b66196fa6cc9e86824dee577e462cbeaf36d715c8fea5bcb08b54d")

Reference:

https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure#com

CVE-2024-4577 Exploits in the Wild One Day After Disclosure

Summary

Indicators of Compromise (IOC) List

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Share This

Comments