Vulnerability · Published Nov 6, 2024 · Assigned by GitHub_M
CVE-2024-50340Ability to change environment from query in symfony/runtime
High 7.3
In plain English
A high-severity injection in symfony from symfony. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 61.8% (higher than 99.2% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | symfony | 5.4.23+dfsg-1+deb12u3 | DSA-5809-1 |
| Debian:12 | symfony | 5.4.53+dfsg-0+deb12u1 | DEBIAN-CVE-2024-50340 |
| Debian:13 | symfony | 6.4.41+dfsg-0+deb13u1 | DEBIAN-CVE-2024-50340 |
| Debian:14 | symfony | 6.4.14+dfsg-1 | DEBIAN-CVE-2024-50340 |
| Packagist | symfony/runtime | 7.1.7 | GHSA-x8vp-gf4q-mw5j |
| Packagist | symfony/runtime | 5.4.46 | GHSA-x8vp-gf4q-mw5j |
| Packagist | symfony/runtime | 6.4.14 | GHSA-x8vp-gf4q-mw5j |
| Packagist | symfony/symfony | 7.1.7 | GHSA-x8vp-gf4q-mw5j |
| Packagist | symfony/symfony | 5.4.46 | GHSA-x8vp-gf4q-mw5j |
| Packagist | symfony/symfony | 6.4.14 | GHSA-x8vp-gf4q-mw5j |
| Ubuntu:25.10 | symfony | no fix listed | UBUNTU-CVE-2024-50340 |
| Ubuntu:26.04:LTS | symfony | no fix listed | UBUNTU-CVE-2024-50340 |
Affected products (as reported)
Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L