CVE-2024-50340

CVE-2024-50340 is a flaw in the symfony/runtime component, the Symfony PHP framework module that decouples PHP applications from global state. When the PHP register_argc_argv directive is enabled, a remote, unauthenticated attacker can send a specially crafted query string to any URL, which the runtime misinterprets as kernel arguments. This allows the attacker to change the environment or debug mode the kernel uses to handle the request, potentially enabling debug mode or switching environments in production and altering application behavior or exposing debug information (CVSS 3.1: 7.3, network vector with low confidentiality, integrity and availability impact). Affected are applications using symfony/runtime versions below 5.4.46, 6.4.14, and 7.1.7 on the 5.4, 6.4, and 7.1 branches respectively; from those versions the SymfonyRuntime ignores argv values for non-SAPI PHP runtimes. No public proof-of-concept or confirmed in-the-wild exploitation is known, but EPSS assigns a high (~64%) probability of exploitation within the next 30 days.

What to do: Upgrade the symfony/runtime component to at least 5.4.46, 6.4.14, or 7.1.7 depending on the major branch in use; there are no known workarounds. In the meantime, verify whether register_argc_argv is set to On in your PHP configuration and consider disabling it where supported, and check web logs for crafted query strings or unexpected environment/debug-mode changes on production requests.