CVE-2025-2689 in Yii2
Summary
by MITRE • 03/24/2025
A vulnerability, which was classified as critical, has been found in yiisoft Yii2 up to 2.0.45. Affected by this issue is the function getIterator of the file symfony\finder\Iterator\SortableIterator.php. The manipulation leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/24/2025
This critical vulnerability in yiisoft Yii2 version 2.0.45 and earlier affects the symfony finder component's SortableIterator.php file through its getIterator function. The flaw enables remote code execution via deserialization attacks, representing a severe security risk that has been publicly disclosed and actively exploited. The vulnerability stems from improper handling of serialized data within the iterator implementation, creating a pathway for attackers to execute arbitrary code on affected systems.
The technical exploitation occurs when the application processes user-controllable input through the SortableIterator class, which deserializes data without adequate validation or sanitization. This deserialization flaw allows attackers to craft malicious serialized objects that, when processed by the getIterator function, trigger unintended code execution. The remote attack vector means that adversaries can exploit this vulnerability through network-based interactions without requiring local system access, making it particularly dangerous for web applications.
From an operational perspective, this vulnerability poses significant risks to applications using Yii2 framework versions up to 2.0.45, as it can lead to complete system compromise, data exfiltration, and persistence mechanisms. The public disclosure of the exploit increases the likelihood of widespread exploitation across vulnerable installations. Organizations running affected versions face potential unauthorized access to sensitive data, application manipulation, and possible lateral movement within network environments.
Security mitigations for this vulnerability include immediate upgrading to yiisoft Yii2 version 2.0.46 or later, which contains the necessary patches to address the deserialization flaw. Additionally, implementing proper input validation and sanitization measures, disabling unnecessary serialization functionality, and employing web application firewalls can provide additional protective layers. Organizations should conduct comprehensive vulnerability assessments to identify all affected systems and implement network segmentation to limit potential attack impact. This vulnerability aligns with CWE-502, which describes deserialization of untrusted data, and maps to ATT&CK technique T1203 for exploitation of remote services and T1059 for command execution through deserialization attacks.