CVE-2024-51736: Symfony Process Command Execution Hijack Vulnerability on Windows
Summary
CVE-2024-51736: Symfony vulnerable to command execution hijack on Windows with Process class. Affects symfony/process across 3 version ranges.
< 5.4.46
>= 6.0.0, < 6.4.14
>= 7.0.0, < 7.1.7
Fixed in 5.4.46, 6.4.14 or 7.1.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a widely-used PHP framework that provides a set of reusable PHP components and a web application framework for building robust applications. The 'Process' component of Symfony allows developers to execute commands in a sub-process, making it a powerful tool for managing system commands. However, a vulnerability has been identified in the way the 'Process' class handles command execution on Windows systems, particularly when an executable named 'cmd.exe' is present in the current working directory.
Vulnerability Detail
The vulnerability arises from the 'Process' class in Symfony, which, when executing commands, can inadvertently call a local 'cmd.exe' executable if it exists in the current working directory. This behavior can lead to command execution hijacking, where an attacker could place a malicious 'cmd.exe' in the directory, potentially allowing them to execute arbitrary commands with the privileges of the application. This issue is particularly critical on Windows systems and has been assigned a CVSS score of 8.4, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.4.465.4.46composer require symfony/process:5.4.46 -
>= 6.0.0, < 6.4.146.4.14composer require symfony/process:6.4.14 -
>= 7.0.0, < 7.1.77.1.7composer require symfony/process:7.1.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that no executable named 'cmd.exe' exists in the current working directory of your application. This can help mitigate the risk of command execution hijacking until the package is updated.
Conclusion
The CVE-2024-51736 vulnerability in the Symfony Process component poses a significant risk for Windows users by allowing command execution hijacking. It is crucial to update to the patched versions to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for symfony/process →
FAQ
CVE-2024-51736 is a vulnerability in the Symfony Process component that allows for command execution hijacking on Windows systems.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
If exploited, this vulnerability could allow an attacker to execute arbitrary commands on the server, potentially leading to data breaches or system compromise.
You can update the Symfony Process component using Composer with the command: 'composer update symfony/process'. Ensure you are using a version that includes the fix.
Yes, the permanent fix is to update to the specified patched versions of the Symfony Process component as outlined in the 'how to fix' section.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/process.
