GHSA-8wgj-6wx8-h5hq CVE-2018-14773
Symfony HTTP Foundation web cache poisoning
- Severity
- 6.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 57.64%
- Chance of exploitation in the next 30 days. Higher than 99.08% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
- Fix
- Available
- 2 packages have a fixed version
Description
An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| symfony/http-foundation | >= 2.7.0, < 2.7.49 |
2.7.49 |
| symfony/http-foundation | >= 2.8.0, < 2.8.44 |
2.8.44 |
| symfony/http-foundation | >= 3.0.0, < 3.3.18 |
3.3.18 |
| symfony/http-foundation | >= 3.4.0, < 3.4.14 |
3.4.14 |
| symfony/http-foundation | >= 4.0.0, < 4.0.14 |
4.0.14 |
| symfony/http-foundation | >= 4.1.0, < 4.1.3 |
4.1.3 |
| symfony/symfony | >= 2.7.0, < 2.7.49 |
2.7.49 |
| symfony/symfony | >= 2.8.0, < 2.8.44 |
2.8.44 |
| symfony/symfony | >= 3.0.0, < 3.3.18 |
3.3.18 |
| symfony/symfony | >= 3.4.0, < 3.4.14 |
3.4.14 |
| symfony/symfony | >= 4.0.0, < 4.0.14 |
4.0.14 |
| symfony/symfony | >= 4.1.0, < 4.1.3 |
4.1.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
symfony/http-foundation Packagist → 2.7.49
- composer
composer require symfony/http-foundation:^2.7.49
symfony/symfony Packagist → 2.7.49
- composer
composer require symfony/symfony:^2.7.49
Severity breakdown
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.
References
Advisories
Other links
- github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation…
- github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-201…
- lists.debian.org/debian-lts-announce/2019/03/msg00009.html
- seclists.org/bugtraq/2019/May/21
- symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers
- debian.org/security/2019/dsa-4441
- drupal.org/SA-CORE-2018-005
- securityfocus.com/bid/104943
- securitytracker.com/id/1041405
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-2v3c-qxhr-7vpv Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process | High | Also affects symfony/symfony |
| GHSA-r925-mgvr-h9cc Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header | High | Also affects symfony/http-foundation |
| GHSA-h5x3-xfc9-m39h Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization | Medium | Also affects symfony/symfony |
| GHSA-v3wm-qf9p-c549 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense | Medium | Also affects symfony/symfony |
| GHSA-rrj9-5q2j-4gvr Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade | Medium | Also affects symfony/symfony |
| GHSA-38cx-cq6f-5755 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient | High | Also affects symfony/http-foundation |
| GHSA-6h46-9jf5-q59x Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes | High | Also affects symfony/symfony |
| GHSA-x5qj-865h-mgvm Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes | Medium | Also affects symfony/symfony |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor