Symfony < 5.4.51 / 6.4.x < 6.4.33 / 7.3.x < 7.3.11 / 7.4.x < 7.4.5 / 8.0.x < 8.0.5 Process Component Argument Injection (GHSA-r39x-jcww-82v6)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(298792);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/02");

  script_cve_id("CVE-2026-24739");
  script_xref(name:"IAVB", value:"2026-B-0029");

  script_name(english:"Symfony < 5.4.51 / 6.4.x < 6.4.33 / 7.3.x < 7.3.11 / 7.4.x < 7.4.5 / 8.0.x < 8.0.5 Process Component Argument Injection (GHSA-r39x-jcww-82v6)");

  script_set_attribute(attribute:"synopsis", value:
"A PHP library installed on the remote host is affected by an argument injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Symfony installed on the remote host is prior to 5.4.51, or 6.4.x prior to 6.4.33, or 7.3.x prior to
7.3.11, or 7.4.x prior to 7.4.5, or 8.0.x prior to 8.0.5. It is, therefore, affected by an argument injection
vulnerability in the Process component. The Symfony Process component did not correctly treat some characters
(notably '=') as special when escaping arguments on Windows. When PHP is executed from an MSYS2-based environment
(e.g. Git Bash) and Symfony Process spawns native Windows executables, MSYS2's argument/path conversion can mis-handle
unquoted arguments containing these characters. This can cause the spawned process to receive corrupted/truncated
arguments compared to what Symfony intended. If an application uses Symfony Process to invoke file-management commands
with a path argument containing '=', the MSYS2 conversion layer may alter the argument at runtime. In affected setups,
this can result in operations being performed on an unintended path, up to and including deletion of the contents of a
broader directory or drive.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number. Also note that this plugin does not distinguish between PHP packages installed via the OS package manager,
PHP packages installed via Composer, or other sources. As a result, packages provided by your OS package repository may
have backported fixes that this plugin may incorrectly report as vulnerable. Please refer to the OS-specific plugins for
CVE-2026-24739 to check for backported fixes.");
  # https://github.com/symfony/symfony/security/advisories/GHSA-r39x-jcww-82v6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?40def815");
  script_set_attribute(attribute:"see_also", value:"https://github.com/symfony/symfony/issues/62921");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Symfony version 5.4.51, 6.4.33, 7.3.11, 7.4.5, 8.0.5 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-24739");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:sensiolabs:symfony");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("php_composer_enum_win.nbin");
  script_require_keys("language_library/package/composer/enumerated");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_php_packages.inc');

var os = get_kb_item_or_exit("Host/OS");
if("windows" >!< tolower(os))
  audit(AUDIT_OS_NOT, "Windows");

get_kb_item_or_exit('language_library/package/composer/enumerated');

var package_name = 'symfony/symfony';
var app_name = 'Symfony';

var constraints = [
  {'fixed_version': '5.4.51'},
  {'min_version': '6.4', 'fixed_version': '6.4.33'},
  {'min_version': '7.3', 'fixed_version': '7.3.11'},
  {'min_version': '7.4', 'fixed_version': '7.4.5'},
  {'min_version': '8.0', 'fixed_version': '8.0.5'}
];

# Process the app info and handle branching internally
vcf::php_packages::process_app_info(package_name:package_name, app_name:app_name, constraints:constraints, severity:SECURITY_WARNING);