CVE-2024-50340: Ability to change environment from query
Description
When the registerargcargv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request.
Resolution
The SymfonyRuntime now ignores the argv values for non-cli SAPIs PHP runtimes
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Vladimir Dusheyko for reporting the issue and Wouter de Jong for providing the fix.
Other sources
CVE-2024-50340: Ability to change environment from query
— Packagist
symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the SymfonyRuntime now ignores the argv values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.1.7 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 6.4.14 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 5.4.46 - Upgrade
Upgrade
composer/symfony/runtimeto a version that resolves this vulnerability.Fixed in 7.1.7 - Upgrade
Upgrade
composer/symfony/runtimeto a version that resolves this vulnerability.Fixed in 6.4.14 - Upgrade
Upgrade
composer/symfony/runtimeto a version that resolves this vulnerability.Fixed in 5.4.46 - Upgrade
Upgrade
debian/symfonyto a version that resolves this vulnerability.Fixed in 5.4.53+dfsg-0+deb12u1 - Upgrade
Upgrade
debian/symfonyto a version that resolves this vulnerability.Fixed in 6.4.41+dfsg-0+deb13u1 - Upgrade
Upgrade
debian/symfonyto a version that resolves this vulnerability.Fixed in 6.4.14+dfsg-1 - Upgrade
Upgrade
debian/symfonyto a version that resolves this vulnerability.Fixed in 5.4.53+dfsg-0+deb12u1Fixed in 6.4.41+dfsg-0+deb13u1Fixed in 6.4.49+dfsg-0+deb13u1Fixed in 7.4.22+dfsg-1Fixed in 7.4.23+dfsg-1 - Upgrade
Upgrade
symfony/runtimeto a version that resolves this vulnerability.Fixed in 5.4.46 - Upgrade
Upgrade
symfony/runtimeto a version that resolves this vulnerability.Fixed in 6.4.14 - Upgrade
Upgrade
symfony/runtimeto a version that resolves this vulnerability.Fixed in 7.1.7
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50340?
The severity of CVE-2024-50340 is considered critical as it can allow an attacker to manipulate the environment settings.
How do I fix CVE-2024-50340?
To fix CVE-2024-50340, update your Symfony packages to the latest versions specified in the vulnerability advisory.
Which Symfony versions are affected by CVE-2024-50340?
CVE-2024-50340 affects Symfony versions between 5.3.0 and 5.4.46, and from 6.0.0 to 6.4.14, and from 7.0.0 to 7.1.7.
What happens if I don't resolve CVE-2024-50340?
Failure to resolve CVE-2024-50340 may result in unauthorized access to sensitive environment configurations.
Is the CVE-2024-50340 vulnerability specific to PHP configurations?
Yes, CVE-2024-50340 is specifically exploitable when the 'register_argc_argv' PHP directive is enabled.