Symfony vulnerable to command execution hijack on Windows with Process class

NGHIÊM TRỌNG 9.8CVE-2024-51736 · GHSA-qq5c-677p-737q · Công bố 06/11/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-51736 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng symfony/process, symfony/symfony, symfony (sensiolabs).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.43%, cao hơn 37.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.4.14, 7.1.7, 5.4.46 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
symfony/process Packagist	`≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46`	`6.4.147.1.75.4.46`
symfony/symfony Packagist	`≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46`	`6.4.147.1.75.4.46`
symfony sensiolabs	`≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46`	`6.4.147.1.75.4.46`

Mô tả

Description

On Windows, when an executable file named cmd.exe is located in the current working directory it will be called by the Process class when preparing command arguments, leading to possible hijacking.

Resolution

The Process class now uses the absolute path to cmd.exe.

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Jordi Boggiano for reporting the issue and Nicolas Grekas for providing the fix.

Mô tả của NVD

Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing command arguments, leading to possible hijacking. This issue has been addressed in release versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.