GHSA-wvjv-p5rr-mmqm CVE-2014-5245

Symfony allows direct access of ESI URLs behind a trusted proxy

High Packagist

Severity: 7.5 / 10; High · CVSS 3.1
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Fix: Available; 2 packages have a fixed version

Description

All 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpKernel component are affected by this security issue. Your application is vulnerable only if the ESI feature is enabled and there is a proxy in front of the web application.

This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.2 as it is not maintained anymore.

Description When you enable the ESI feature and when you are using a proxy like Varnish that you configured as a trusted proxy, the FragmentHandler considered requests to render fragments as coming from a trusted source, even if the client was requesting them directly. Symfony can not distinguish between ESI requests done on behalf of the client by Varnish and faked fragment requests coming directly from the client.

To mitigate this issue, and for not-supported Symfony versions, you can use the following workaround in your Varnish configuration (/_fragment being the URL path prefix configured under the fragment setting of the framework bundle configuration):

Copy sub vcl_recv { if (req.restarts == 0 && req.url ~ "^/_fragment") { error 400; } } Resolution We do not rely on trusted IPs anymore when validating a fragment request as all fragment URLs are now signed.

The patch for this issue is available here: https://github.com/symfony/symfony/pull/11831

Affected versions

Packagist

Package	Vulnerable	Fixed in
symfony/http-kernel	`>= 2.0.0, < 2.3.19`	`2.3.19`
symfony/http-kernel	`>= 2.4.0, < 2.4.9`	`2.4.9`
symfony/http-kernel	`>= 2.5.0, < 2.5.4`	`2.5.4`
symfony/symfony	`>= 2.0.0, < 2.3.19`	`2.3.19`
symfony/symfony	`>= 2.4.0, < 2.4.9`	`2.4.9`
symfony/symfony	`>= 2.5.0, < 2.5.4`	`2.5.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

symfony/http-kernel Packagist → `2.3.19`

composer

composer require symfony/http-kernel:^2.3.19

symfony/symfony Packagist → `2.3.19`

composer

composer require symfony/symfony:^2.3.19

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it

Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Timeline

May 30, 2024 Published
May 30, 2024 Last updated by the source

Advisory	Severity	Why it's related
GHSA-2v3c-qxhr-7vpv Symfony: Unbounded Recursion in the YAML Inline Lexer Lets a Single Document Crash the Process	High	Also affects symfony/symfony
GHSA-r925-mgvr-h9cc Symfony: ReDoS in HeaderUtils::split() Reachable Through the Cache-Control Request Header	High	Also affects symfony/symfony
GHSA-h5x3-xfc9-m39h Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization	Medium	Also affects symfony/symfony
GHSA-v3wm-qf9p-c549 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense	Medium	Also affects symfony/symfony
GHSA-rrj9-5q2j-4gvr Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade	Medium	Also affects symfony/symfony
GHSA-38cx-cq6f-5755 Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient	High	Also affects symfony/symfony
GHSA-6h46-9jf5-q59x Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes	High	Also affects symfony/symfony
GHSA-x5qj-865h-mgvm Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes	Medium	Also affects symfony/symfony

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor