CyberRota Analysis
AI-GeneratedThe Symfony PHP framework versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12 are vulnerable due to the server:log listener binding to 0.0.0.0:9911, allowing unauthenticated remote hosts to send malicious serialized PHP payloads. This vulnerability can lead to service crashes and potential object-injection attacks, posing a significant risk to web applications utilizing these versions. Organizations using affected Symfony versions should prioritize upgrading to the patched releases to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the server:log listener (Symfony\Bridge\Monolog\Command\ServerLogCommand) binds to 0.0.0.0:9911 by default and processes each received frame with unserialize(base64_decode($message)) without authentication, integrity checks, or an allowed_classes allowlist, allowing any reachable host to submit attacker-chosen serialized PHP payloads that can crash the listener and may trigger object-injection gadget effects. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.
Related CVEs
Other vulnerabilities affecting the same vendor(s)