CVE-2024-50340

Deeper analysis

Symfony/runtime, a component of the Symfony PHP framework that decouples applications from global state, contains an injection vulnerability (CWE-74) when the PHP directive register_argv_argc is enabled. An attacker supplying a specially crafted query string can alter the environment variables or debug mode passed to the application kernel during request handling. The issue affects Symfony versions prior to 5.4.46, 6.4.14, and 7.1.7.

Unauthenticated remote attackers can exploit the flaw over the network simply by accessing any URL with a malicious query string, achieving limited control over the runtime context without requiring authentication or user interaction. This can result in changes to application behavior that affect confidentiality, integrity, and availability, consistent with the CVSS 7.3 rating.

The Symfony security advisory and associated commit state that SymfonyRuntime now explicitly ignores argv values for non-SAPI PHP runtimes in the fixed releases. No workarounds are known, and all users are advised to upgrade immediately.

The EPSS score currently stands at 0.8662 with a recorded peak of 0.8902, indicating sustained exploitation interest following disclosure.