CVE-2014-6072: Symfony Web Profiler Cross-Site Request Forgery Vulnerability
Summary
CVE-2014-6072: Symfony Cross-Site Request Forgery vulnerability in the Web Profiler. Affects symfony/symfony across 3 version ranges.
>= 2.0.0, < 2.3.19
>= 2.4.0, < 2.4.9
>= 2.5.0, < 2.5.4
Fixed in 2.3.19, 2.4.9 or 2.5.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a popular PHP web application framework used for developing robust and scalable applications. The Symfony Web Profiler is a development tool that provides detailed information about a Symfony project, including user logins, executed SQL statements, and other sensitive data. However, it should not be enabled on production servers or should be properly secured to prevent unauthorized access. The Web Profiler bundle versions 2.0.X to 2.5.X are affected by a Cross-Site Request Forgery (CSRF) vulnerability.
Vulnerability Detail
The import/export feature of the Symfony Web Profiler is vulnerable to CSRF attacks. This feature allows the import of profiler data as a PHP serialized string, making the application susceptible to code injection. An attacker can exploit this vulnerability to execute arbitrary code on the server. This can lead to unauthorized access, data leakage, and potential compromise of the entire application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.3.192.3.19composer require symfony/symfony:2.3.19 -
>= 2.4.0, < 2.4.92.4.9composer require symfony/symfony:2.4.9 -
>= 2.5.0, < 2.5.42.5.4composer require symfony/symfony:2.5.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The Symfony Web Profiler bundle versions 2.0.X to 2.5.X are affected by a Cross-Site Request Forgery (CSRF) vulnerability in the import/export feature. This vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire application. To fix this vulnerability, developers should no longer rely on the import/export feature and instead use the profiler:import and profiler:export Symfony commands provided by the WebProfiler bundle from the command line interface. It is crucial to properly secure the Web Profiler or avoid enabling it on production servers. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for symfony/symfony →
FAQ
The Symfony Web Profiler is a development tool that provides detailed information about a Symfony project, including user logins, executed SQL statements, and other sensitive data. It should not be enabled on production servers or should be properly secured to prevent unauthorized access.
Cross-Site Request Forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. In the case of the Symfony Web Profiler vulnerability, an attacker can exploit the import/export feature to execute arbitrary code on the server.
This vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire application. An attacker can execute arbitrary code on the server, potentially gaining control over sensitive data and performing malicious actions.
To fix this vulnerability, the import/export feature has been removed from the Web interface and moved as CLI commands. Developers should no longer rely on this feature and instead use the profiler:import and profiler:export Symfony commands provided by the WebProfiler bundle from the command line interface.
No, the import/export feature has been removed from the Web interface due to security concerns. Developers should use the CLI commands profiler:import and profiler:export instead.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/symfony.
