Fluid Attacks Database

Description

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the register_argv_argc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the SymfonyRuntime now ignores the argv values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	symfony	=5.4.23+dfsg-1 \|\| =5.4.23+dfsg-1+deb12u1 \|\| =5.4.23+dfsg-1+deb12u2 \|\| =5.4.23+dfsg-1+deb12u3 \|\| =5.4.23+dfsg-1+deb12u4 \|\| =5.4.23+dfsg-1+deb12u5 \|\| =5.4.24+dfsg-1 \|\| =5.4.25+dfsg-1 \|\| =5.4.27+dfsg-1 \|\| =5.4.28+dfsg-1 \|\| =5.4.29+dfsg-1 \|\| =5.4.30+dfsg-1 \|\| =5.4.31+dfsg-1 \|\| =5.4.31+dfsg-2 \|\| =5.4.32+dfsg-1 \|\| =5.4.33+dfsg-1 \|\| =5.4.34+dfsg-1 \|\| =5.4.34+dfsg-2 \|\| =5.4.35+dfsg-1 \|\| =5.4.35+dfsg-2 \|\| =5.4.35+dfsg-3 \|\| =5.4.52+dfsg-0+deb12u1 \|\| >=0 <5.4.53+dfsg-0+deb12u1	5.4.53+dfsg-0+deb12u1
debian 13	symfony	=6.4.21+dfsg-2 \|\| =6.4.21+dfsg-2+deb13u1 \|\| =6.4.24+dfsg-1 \|\| =6.4.25+dfsg-1 \|\| =6.4.40+dfsg-0+deb13u1 \|\| >=0 <6.4.41+dfsg-0+deb13u1	6.4.41+dfsg-0+deb13u1
packagist	symfony/symfony	>=5.3.0 <5.4.46 \|\| >=6.0.0 <6.4.14 \|\| >=7.0.0 <7.1.7	5.4.46, 6.4.14, 7.1.7
packagist	symfony/runtime	>=5.3.0 <5.4.46 \|\| >=6.0.0 <6.4.14 \|\| >=7.0.0 <7.1.7	5.4.46, 6.4.14, 7.1.7
debian 14	symfony	>=0 <6.4.14+dfsg-1	6.4.14+dfsg-1

Aliases

1. CVE-2024-503402. NVD-2024-503403. OSV-DEBIAN-2024-503404. OSV-2024-503405. GHSA-x8vp-gf4q-mw5j6. GCVE-2024-503407. SECURITY-TRACKER-CVE-2024-50340

References

1. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-50340.yaml2. https://github.com/Nyamort/CVE-2024-503403. https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j4. https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa5. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/runtime/CVE-2024-50340.yaml6. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2024-50340.yaml7. https://symfony.com/cve-2024-50340

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.