CVE-2025-2689: Yiiframework Yii RCE Vulnerability

CVE-2025-2689 Overview

A critical insecure deserialization vulnerability has been identified in yiisoft Yii2 framework versions up to 2.0.45. This vulnerability affects the getIterator function within the symfony\finder\Iterator\SortableIterator.php file, where improper handling of serialized data can lead to remote code execution. The attack can be launched remotely by manipulating serialized objects, potentially allowing attackers to execute arbitrary code on vulnerable systems.

Critical Impact

Remote attackers can exploit the deserialization flaw in the SortableIterator component to execute arbitrary code, potentially leading to complete system compromise of web applications built on the Yii2 framework.

Affected Products

• yiisoft Yii2 up to version 2.0.45
• Applications using the Symfony Finder Iterator component through Yii2
• Web applications built on vulnerable Yiiframework Yii versions

Discovery Timeline

• 2025-03-24 - CVE-2025-2689 published to NVD
• 2025-03-24 - Last updated in NVD database

Technical Details for CVE-2025-2689

Vulnerability Analysis

This vulnerability represents an insecure deserialization flaw (CWE-502) combined with improper input validation (CWE-20) in the Yii2 PHP framework. The vulnerability exists in the getIterator function of the SortableIterator.php file, which is part of the Symfony Finder component integrated within Yii2.

Insecure deserialization occurs when an application deserializes untrusted data without adequate verification. In this case, the getIterator function processes serialized objects that can be manipulated by attackers to inject malicious payloads. When the application deserializes these crafted objects, it can trigger arbitrary code execution through PHP's magic methods such as __wakeup() or __destruct().

The vulnerability is particularly dangerous because it can be exploited remotely over the network without requiring any user interaction. An authenticated attacker with low-level privileges can craft malicious serialized payloads to achieve code execution on the target server.

Root Cause

The root cause of this vulnerability lies in the unsafe deserialization of user-controlled data within the SortableIterator class. The getIterator function fails to properly validate or sanitize serialized input before processing, allowing attackers to inject malicious PHP objects that execute code upon deserialization.

PHP's unserialize() function is inherently dangerous when used with untrusted data because it can instantiate arbitrary objects and invoke magic methods. The Yii2 framework's implementation does not implement adequate safeguards such as allowlisting of acceptable classes or using safer serialization alternatives like JSON.

Attack Vector

The attack is network-based and can be executed remotely against vulnerable Yii2 applications. An attacker would craft a malicious serialized PHP object containing a gadget chain that, when deserialized by the getIterator function, triggers arbitrary code execution.

The exploitation flow involves:

1. Identifying a Yii2 application using a vulnerable version
2. Crafting a serialized payload containing PHP Object Injection gadgets
3. Submitting the payload to an endpoint that triggers deserialization in the SortableIterator component
4. The malicious object is deserialized, executing attacker-controlled code on the server

For technical details on this vulnerability, refer to the GitHub Yii2 Security Guide and VulDB #300710.

Detection Methods for CVE-2025-2689

Indicators of Compromise

• Unusual serialized data patterns in HTTP request parameters, cookies, or POST bodies containing PHP object notation
• Unexpected file system access or process execution originating from PHP processes
• Web server logs showing requests with base64-encoded or URL-encoded serialized PHP objects
• Evidence of gadget chain classes being instantiated in application logs

Detection Strategies

• Monitor web application firewalls (WAF) for patterns indicative of PHP object injection, including serialized object markers such as O: followed by class names
• Implement application-level logging to detect deserialization of unexpected object types
• Deploy runtime application self-protection (RASP) solutions to detect and block deserialization attacks
• Use SentinelOne's behavioral analysis to identify post-exploitation activities such as unexpected command execution

Monitoring Recommendations

• Enable verbose logging for the Yii2 framework to capture deserialization events
• Configure intrusion detection systems to alert on PHP object injection patterns in network traffic
• Monitor server processes for anomalous child process spawning from web server or PHP-FPM processes
• Implement file integrity monitoring on critical application directories

How to Mitigate CVE-2025-2689

Immediate Actions Required

• Upgrade Yii2 framework to the latest patched version beyond 2.0.45 as soon as patches become available
• Audit application code for any direct use of the vulnerable SortableIterator component
• Implement input validation to reject serialized data from untrusted sources
• Consider using JSON or other safer serialization formats instead of PHP serialization

Patch Information

Organizations should monitor the official Yiiframework repository and security advisories for patch releases addressing this vulnerability. Additional context is available through VulDB #300710 and the VulDB CTI entry.

Until an official patch is released, organizations should implement the workarounds below and consider virtual patching through WAF rules.

Workarounds

• Implement WAF rules to block requests containing PHP serialized object patterns targeting the affected component
• If possible, disable or remove the Symfony Finder Iterator component if not required by your application
• Add allowlisting of permitted classes in any deserialization operations using unserialize() with the allowed_classes option
• Deploy network segmentation to limit the exposure of vulnerable Yii2 applications

# WAF rule example for ModSecurity to detect PHP serialization attacks
SecRule REQUEST_BODY "@rx O:\d+:\"[^\"]+\":\d+:" \
    "id:100001,phase:2,deny,status:403,msg:'PHP Object Injection Attempt Detected'"