CVE-2015-4050: Symfony Incorrect Access Control
Summary
CVE-2015-4050: Symfony Incorrect Access Control. Affects symfony/http-kernel across 4 version ranges.
>= 2.3.19, < 2.3.29
>= 2.4.9, <= 2.4.10
>= 2.5.4, < 2.5.12
>= 2.6.0, < 2.6.8
Fixed in 2.3.29, 2.5.12 or 2.6.8, depending on the release line you run. How to fix ↓
Also tracked for
- symfony · Debian:11
The same CVE-2015-4050 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a popular PHP framework that provides a set of reusable components and tools for building web applications. It follows the Model-View-Controller (MVC) architectural pattern and offers various features for rapid development. The vulnerability in question affects Symfony versions 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7. Symfony allows the use of Edge Side Includes (ESI) or Server Side Includes (SSI) for dynamic content assembly. However, the FragmentListener component in the HttpKernel module fails to properly validate the _controller attribute, enabling attackers to bypass URL signing and security rules.
Vulnerability Detail
The vulnerability arises from the lack of proper validation in the FragmentListener component of Symfony's HttpKernel module. When ESI or SSI support is enabled, the component does not check if the _controller attribute is set. This oversight allows remote attackers to bypass URL signing and security rules by including either no hash or an invalid hash in a request to /_fragment. The impact of this vulnerability can be significant, as it undermines the intended security measures and may lead to unauthorized access or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.19, < 2.3.292.3.29composer require symfony/http-kernel:2.3.29 -
>= 2.5.4, < 2.5.122.5.12composer require symfony/http-kernel:2.5.12 -
>= 2.6.0, < 2.6.82.6.8composer require symfony/http-kernel:2.6.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, if upgrading to the patched versions is not immediately feasible, it is advisable to disable ESI or SSI support in Symfony. By disabling these features, the vulnerability can be mitigated until a proper update can be applied. To disable ESI or SSI support, the relevant configuration settings in Symfony need to be adjusted accordingly.
Conclusion
The vulnerability in Symfony's FragmentListener component can be mitigated by updating to the latest patched versions or by disabling ESI or SSI support. It is crucial to apply the necessary fixes to prevent potential security breaches. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for symfony/http-kernel →
FAQ
Symfony is a PHP framework that provides reusable components and tools for building web applications. It follows the Model-View-Controller (MVC) architectural pattern and offers various features for rapid development.
The vulnerability affects Symfony versions 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7.
The vulnerability allows remote attackers to bypass URL signing and security rules, potentially leading to unauthorized access or other malicious activities.
To fix this vulnerability, it is recommended to update Symfony to the latest patched versions (2.3.29, 2.5.12, or 2.6.8).
Yes, as a temporary workaround, you can disable ESI or SSI support in Symfony until the vulnerability is fixed.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/http-kernel.
