CVE-2015-2308: Symfony Vulnerable to PHP Eval Injection
Summary
CVE-2015-2308: Symfony Vulnerable to PHP Eval Injection. Affects symfony/symfony across 3 version ranges.
>= 2.0.0, < 2.3.27
>= 2.4.0, < 2.5.11
>= 2.6.0, < 2.6.6
Fixed in 2.3.27, 2.5.11 or 2.6.6, depending on the release line you run. How to fix ↓
Also tracked for
- symfony · Debian:11
The same CVE-2015-2308 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a popular PHP framework used for developing web applications. It provides a set of reusable components and libraries that simplify the development process. The Symfony HttpKernel component is responsible for handling HTTP requests and responses. It includes a built-in reverse proxy called HttpCache, which is used for caching and accelerating web applications. However, applications with ESI (Edge Side Includes) support enabled and using the Symfony HttpCache class are vulnerable to PHP code injection.
Vulnerability Detail
The vulnerability arises from the use of eval() function in HttpCache to execute files in its cache that contain ESI tags. The problem is that PHP allows the execution of code within <script language="php"> tags, which are always available regardless of the configuration. This allows a malicious user to inject PHP code that will be executed by the server. An attacker can exploit this vulnerability by passing a user-submitted variable containing a PHP tag without proper output escaping. This can lead to remote code execution and potential compromise of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.3.272.3.27composer require symfony/symfony:2.3.27 -
>= 2.4.0, < 2.5.112.5.11composer require symfony/symfony:2.5.11 -
>= 2.6.0, < 2.6.62.6.6composer require symfony/symfony:2.6.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a workaround is to disable ESI support in the application. This can be done by modifying the application's configuration to remove or comment out the ESI-related settings. By disabling ESI, the vulnerability is mitigated, but it may impact the performance and functionality of the application.
Conclusion
The vulnerability in Symfony that allows PHP code injection can have serious consequences for the security of web applications. It is crucial to upgrade to a fixed version of Symfony or HttpKernel to mitigate this vulnerability. If immediate upgrading is not possible, disabling ESI support can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for symfony/symfony →
FAQ
Symfony is a PHP framework used for developing web applications. It provides a set of reusable components and libraries that simplify the development process.
The Symfony HttpKernel component is responsible for handling HTTP requests and responses in Symfony applications. It includes features like routing, caching, and session management.
ESI (Edge Side Includes) is a feature that allows web pages to include content from other sources. It is often used for caching and accelerating web applications.
The vulnerability arises from the use of eval() function in the Symfony HttpCache class to execute files in its cache that contain ESI tags. The problem is that PHP allows the execution of code within <script language="php"> tags, which are always available regardless of the configuration.
The vulnerability allows a malicious user to inject PHP code that will be executed by the server. This can lead to remote code execution and potential compromise of the application.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/symfony.
