Listen to this Post
The vulnerability exists within Symfony’s Process component for Windows when PHP is executed from an MSYS2 shell like Git Bash. The component’s argument escaping logic failed to properly quote the equals sign (=) character. When spawning a native Windows executable, the MSYS2 runtime performs automatic path conversion on unquoted arguments. An argument containing an unquoted `=` is incorrectly parsed by MSYS2, causing the argument string to be truncated or corrupted at that character. This results in the target process receiving a different, unintended argument than what the Symfony application passed, such as a truncated file path.
Platform: Symfony (PHP)
Version: < Patched 5.4
Vulnerability: Argument Injection
Severity: Critical
date: 2025-03-19
Prediction: 2025-04-02
What Undercode Say:
Analytics:
Simulating argument corruption in MSYS2/Git Bash $ echo test=with=equals test=with=equals MSYS2 may interpret '=' as a shell variable assignment without proper quoting. export MSYS2_ARG_CONV_EXCL=""
// Example vulnerable Symfony Process call use Symfony\Component\Process\Process; $path = 'C:/temp/dir=name'; // User-controlled path $process = new Process(['rmdir', $path]); // Argument may be corrupted $process->run();
How Exploit:
Attacker controls path.
Path contains ‘=’ character.
Process executes with wrong argument.
Leads to arbitrary file deletion.
Protection from this CVE:
Apply Symfony patch.
Upgrade Symfony version.
Use cmd/PowerShell.
Set MSYS2_ARG_CONV_EXCL.
Sanitize path inputs.
Impact:
Directory deletion.
Data loss.
Code execution potential.
System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
