SecBoard
Zurück zur CVE-Übersicht

CVE-2026-17545

NONE
Risk Signal Score5/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

Beschreibung

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 8.2.34
  • 8.3.35
  • 8.4.26
  • 8.5.11

Threat-Hunting-Queries

Sentinel/Defender KQL

DeviceFileEvents
| where InitiatingProcessCommandLine has_any ("CON", "PRN", "AUX", "NUL", "COM1", "COM2", "COM3", "COM4", "COM5", "COM6", "COM7", "COM8", "COM9", "LPT1", "LPT2", "LPT3", "LPT4", "LPT5", "LPT6", "LPT7", "LPT8", "LPT9", "CONIN$", "CONOUT$")
| where InitiatingProcessFileName =~ "php.exe" or InitiatingProcessParentFileName =~ "php.exe"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, FolderPath, ActionType

Splunk SPL

(sourcetype=WinEventLog OR sourcetype=ms:defender:atp) (php.exe) (CON OR PRN OR AUX OR NUL OR COM1 OR COM2 OR COM3 OR COM4 OR COM5 OR COM6 OR COM7 OR COM8 OR COM9 OR LPT1 OR LPT2 OR LPT3 OR LPT4 OR LPT5 OR LPT6 OR LPT7 OR LPT8 OR LPT9 OR CONIN$ OR CONOUT$)
| table _time, host, Image, CommandLine, FileName, ParentImage

Sigma

title: PHP Windows Reserved Device Name DoS
id: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
status: experimental
description: Detects attempts to open reserved device names via PHP on Windows, which can lead to Denial of Service.
author: SecBoard
date: 2026/09/24
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\php.exe'
    CommandLine|contains:
      - 'CON'
      - 'PRN'
      - 'AUX'
      - 'NUL'
      - 'COM1'
      - 'COM2'
      - 'COM3'
      - 'COM4'
      - 'COM5'
      - 'COM6'
      - 'COM7'
      - 'COM8'
      - 'COM9'
      - 'LPT1'
      - 'LPT2'
      - 'LPT3'
      - 'LPT4'
      - 'LPT5'
      - 'LPT6'
      - 'LPT7'
      - 'LPT8'
      - 'LPT9'
      - 'CONIN$'
      - 'CONOUT$'
  condition: selection
fields:
  - Image
  - CommandLine
  - ParentImage
tags:
  - attack.dos
  - cve.2026.17545

Elastic ES|QL

from process where process.executable.endswith('php.exe') and (process.args : ('*CON*', '*PRN*', '*AUX*', '*NUL*', '*COM1*', '*COM2*', '*COM3*', '*COM4*', '*COM5*', '*COM6*', '*COM7*', '*COM8*', '*COM9*', '*LPT1*', '*LPT2*', '*LPT3*', '*LPT4*', '*LPT5*', '*LPT6*', '*LPT7*', '*LPT8*', '*LPT9*', '*CONIN$*', '*CONOUT$*')) | select @timestamp, host.name, process.executable, process.command_line, process.parent.executable

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen