Skip to content
Log inStart free trial

GHSA-vfm6-r2gc-pwww

Symfony2 security issue when the trust proxy mode is enabled

Medium Packagist
Severity
Medium
The publisher's own rating, not a CVSS score
Exploit chance (EPSS)
—
No score published
Known exploited
No
Not in CISA's catalog
Weakness
—
Not classified
Fix
Available
2 packages have a fixed version

Description

An application is vulnerable if it uses the client IP address as returned by the Request::getClientIp() method for sensitive decisions like IP based access control.

To fix this security issue, the following changes have been made to all versions of Symfony2:

A new Request::setTrustedProxies() method has been introduced and should be used intead of Request::trustProxyData() to enable the trust proxy mode. It takes an array of trusted proxy IP addresses as its argument:

// before (probably in your front controller script)
Request::trustProxyData();

// after
Request::setTrustedProxies(array('1.1.1.1'));
// 1.1.1.1 being the IP address of a trusted reverse proxy

The Request::trustProxyData() method has been deprecated (when used, it automatically trusts the latest proxy in the chain -- which is the current remote address):

Request::trustProxyData();

// is equivalent to
Request::setTrustedProxies(array($request->server->get('REMOTE_ADDR')));

We encourage all Symfony2 users to upgrade as soon as possible. It you don't want to upgrade to the latest version yet, you can also apply the following patches:

  • Patch for Symfony 2.0.19
  • Patch for Symfony 2.1.4

Affected versions

Packagist

PackageVulnerableFixed in
symfony/http-foundation
>= 2.0.0, < 2.0.19
2.0.19
symfony/http-foundation
>= 2.1.0, < 2.1.4
2.1.4
symfony/symfony
>= 2.0.0, < 2.0.19
2.0.19
symfony/symfony
>= 2.1.0, < 2.1.4
2.1.4

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

symfony/http-foundation Packagist → 2.0.19

composer
composer require symfony/http-foundation:^2.0.19

symfony/symfony Packagist → 2.0.19

composer
composer require symfony/symfony:^2.0.19

References

Other links

Timeline

  1. Published
  2. Last updated by the source
AdvisorySeverityWhy it's related
GHSA-2v3c-qxhr-7vpv
Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process
High Also affects symfony/symfony
GHSA-r925-mgvr-h9cc
Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header
High Also affects symfony/http-foundation
GHSA-h5x3-xfc9-m39h
Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization
Medium Also affects symfony/symfony
GHSA-v3wm-qf9p-c549
Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense
Medium Also affects symfony/symfony
GHSA-rrj9-5q2j-4gvr
Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
Medium Also affects symfony/symfony
GHSA-38cx-cq6f-5755
Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient
High Also affects symfony/http-foundation
GHSA-6h46-9jf5-q59x
Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes
High Also affects symfony/symfony
GHSA-x5qj-865h-mgvm
Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes
Medium Also affects symfony/symfony
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor