CVE-2015-2309: Symfony HttpFoundation Request Class Unsafe Methods
Summary
CVE-2015-2309: Symfony has unsafe methods in the Request class. Affects symfony/http-foundation across 3 version ranges.
>= 2.0.0, < 2.3.27
>= 2.4.0, < 2.5.11
>= 2.6.0, < 2.6.6
Fixed in 2.3.27, 2.5.11 or 2.6.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Symfony HttpFoundation component is a PHP library that provides an object-oriented layer for the HTTP protocol. It offers classes and methods to handle HTTP requests and responses, manage sessions, and handle file uploads. The Request class is a key component that represents an HTTP request and provides various methods to access request information. However, versions 2.0.X to 2.6.X of the Symfony HttpFoundation component are affected by a security vulnerability.
Vulnerability Detail
The vulnerability in the Symfony HttpFoundation Request class arises from unsafe methods, including getPort(), isSecure(), getHost(), and getClientIps(). The class assumes that the remote address is trusted if at least one trusted proxy is involved in the request. This assumption can be exploited in a man-in-the-middle attack between the trusted proxy and the web server. An attacker can manipulate the remote address and potentially bypass security measures or gain unauthorized access.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.3.272.3.27composer require symfony/http-foundation:2.3.27 -
>= 2.4.0, < 2.5.112.5.11composer require symfony/http-foundation:2.5.11 -
>= 2.6.0, < 2.6.62.6.6composer require symfony/http-foundation:2.6.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating to the fixed versions is the recommended solution.
Conclusion
The Symfony HttpFoundation component is vulnerable to a security issue in the Request class. It is crucial to update to the fixed versions to mitigate the risk of man-in-the-middle attacks and unauthorized access. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for symfony/http-foundation →
FAQ
The vulnerability allows for potential man-in-the-middle attacks and can lead to unauthorized access or bypassing of security measures.
Versions 2.0.X to 2.6.X of the Symfony HttpFoundation component are affected.
There are no known public exploits for this vulnerability at the time of this report.
Yes, the CVSS score for this vulnerability is 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
No, fixes are not provided for Symfony versions 2.0, 2.1, 2.2, and 2.4 as they are no longer maintained. It is recommended to update to a supported version.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/http-foundation.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.