Symfony Runtime Argument Parsing Vulnerability Allows Environment Variable Manipulation

A vulnerability exists in Symfony's runtime component that can be exploited to manipulate application environment variables. This issue arises in Symfony versions 5.4.46 prior to 5.4.52, 6.4.14 prior to 6.4.40, 7.1.7 prior to 7.4.12, and 8.0.0 prior to 8.0.12. The vulnerability exploits a mismatch between how the web server and the 'parse_str()' function handle query strings, allowing an attacker to send crafted flags that alter the 'APP_ENV' and 'APP_DEBUG' variables. The problem is exacerbated when the 'register_argc_argv' directive is enabled, as it allows the server to pass these flags through '$_SERVER['argv']' to the application.

Impact

Exploitation of this vulnerability can lead to unauthorized changes in the application's environment configuration, specifically the 'APP_ENV' and 'APP_DEBUG' variables. This could potentially allow an attacker to manipulate application behavior or access sensitive information, depending on how these variables are used within the application.

Reproduction

To reproduce this vulnerability, send a GET request with a crafted query string that includes the desired '--env' and '--no-debug' flags. Ensure that the 'register_argc_argv' directive is enabled, as this allows the web server to pass the flags through '$_SERVER['argv']'. The Symfony application must be booted using the 'symfony/runtime' component, which will parse the argv flags and apply them to the application environment.

Remediation

Users can upgrade to Symfony versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12, where this vulnerability has been fixed.