Symfony Process Component < 5.4.51 / 6.4.x < 6.4.33 / 7.3.x < 7.3.11 / 7.4.x < 7.4.5 / 8.0.x < 8.0.5 Argument Injection (GHSA-r39x-jcww-82v6)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(298793);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/30");

  script_cve_id("CVE-2026-24739");
  script_xref(name:"IAVB", value:"2026-B-0029");

  script_name(english:"Symfony Process Component < 5.4.51 / 6.4.x < 6.4.33 / 7.3.x < 7.3.11 / 7.4.x < 7.4.5 / 8.0.x < 8.0.5 Argument Injection (GHSA-r39x-jcww-82v6)");

  script_set_attribute(attribute:"synopsis", value:
"A PHP library installed on the remote host is affected by an argument injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Symfony Process Component installed on the remote host is prior to 5.4.51, or 6.4.x prior to 6.4.33, 
or 7.3.x prior to 7.3.11, or 7.4.x prior to 7.4.5, or 8.0.x prior to 8.0.5. It is, therefore, affected by an argument 
injection vulnerability. The Symfony Process component did not correctly treat some characters (notably '=') as special 
when escaping arguments on Windows. When PHP is executed from an MSYS2-based environment (e.g. Git Bash) and Symfony 
Process spawns native Windows executables, MSYS2's argument/path conversion can mis-handle unquoted arguments containing 
these characters. This can cause the spawned process to receive corrupted/truncated arguments compared to what Symfony 
intended. If an application uses Symfony Process to invoke file-management commands with a path argument containing '=', 
the MSYS2 conversion layer may alter the argument at runtime. In affected setups, this can result in operations being 
performed on an unintended path, up to and including deletion of the contents of a broader directory or drive.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number. Also note that this plugin does not distinguish between PHP packages installed via the OS package manager,
PHP packages installed via Composer, or other sources. As a result, packages provided by your OS package repository may
have backported fixes that this plugin may incorrectly report as vulnerable. Please refer to the OS-specific plugins for
CVE-2026-24739 to check for backported fixes.");
  # https://github.com/symfony/symfony/security/advisories/GHSA-r39x-jcww-82v6
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?40def815");
  script_set_attribute(attribute:"see_also", value:"https://github.com/symfony/symfony/issues/62921");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Symfony Process Component version 5.4.51, 6.4.33, 7.3.11, 7.4.5, 8.0.5 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:H/Au:N/C:N/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-24739");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/28");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/12");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:sensiolabs:symfony");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("php_composer_enum_win.nbin");
  script_require_keys("language_library/package/composer/enumerated");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_php_packages.inc');

var os = get_kb_item_or_exit("Host/OS");
if("windows" >!< tolower(os))
  audit(AUDIT_OS_NOT, "Windows");

get_kb_item_or_exit('language_library/package/composer/enumerated');

var package_name = 'symfony/process';
var app_name = 'Symfony Process Component';

var constraints = [
  {'fixed_version': '5.4.51'},
  {'min_version': '6.4', 'fixed_version': '6.4.33'},
  {'min_version': '7.3', 'fixed_version': '7.3.11'},
  {'min_version': '7.4', 'fixed_version': '7.4.5'},
  {'min_version': '8.0', 'fixed_version': '8.0.5'}
];

# Process the app info and handle branching internally
vcf::php_packages::process_app_info(package_name:package_name, app_name:app_name, constraints:constraints, severity:SECURITY_WARNING);