CVE-2014-5245: Symfony HttpKernel Component ESI URLs Direct Access Vulnerability
Summary
CVE-2014-5245: Symfony allows direct access of ESI URLs behind a trusted proxy. Affects symfony/http-kernel across 3 version ranges.
>= 2.0.0, < 2.3.19
>= 2.4.0, < 2.4.9
>= 2.5.0, < 2.5.4
Fixed in 2.3.19, 2.4.9 or 2.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Symfony HttpKernel component is a key part of the Symfony framework, responsible for handling HTTP requests and responses. It provides a foundation for building web applications in PHP. The ESI (Edge Side Includes) feature allows for the inclusion of dynamic content from different sources in a web page. This vulnerability affects versions 2.2.X, 2.3.X, 2.4.X, and 2.5.X of the Symfony HttpKernel component.
Vulnerability Detail
The vulnerability arises when the ESI feature is enabled and a trusted proxy, such as Varnish, is used. The FragmentHandler in Symfony considers requests to render fragments as coming from a trusted source, even if the client is requesting them directly. This means that Symfony cannot differentiate between legitimate ESI requests made by the proxy and forged fragment requests made directly by the client. An attacker could exploit this to bypass security measures and potentially access sensitive information or perform unauthorized actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.3.192.3.19composer require symfony/http-kernel:2.3.19 -
>= 2.4.0, < 2.4.92.4.9composer require symfony/http-kernel:2.4.9 -
>= 2.5.0, < 2.5.42.5.4composer require symfony/http-kernel:2.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
To mitigate the vulnerability in unsupported Symfony versions, the following workaround can be implemented in the Varnish configuration:
sub vcl_recv {
if (req.restarts == 0 && req.url ~ "^/_fragment") {
error 400;
}
}
Conclusion
The Symfony HttpKernel component is vulnerable to direct access of ESI URLs behind a trusted proxy. This can lead to unauthorized access and potential security breaches. It is crucial to upgrade to the fixed versions or implement the provided workaround to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for symfony/http-kernel →
FAQ
The vulnerability allows an attacker to bypass security measures and potentially access sensitive information or perform unauthorized actions.
Versions 2.2.X, 2.3.X, 2.4.X, and 2.5.X of the Symfony HttpKernel component are affected.
No fixes are provided for Symfony 2.2 as it is no longer maintained.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the composer.lock file.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/http-kernel.
