CVE-2024-50342: Symfony HTTP Client Internal Address and Port Enumeration Vulnerability
Summary
CVE-2024-50342: Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient. Affects symfony/http-client across 3 version ranges.
>= 4.3.0, < 5.4.47
>= 6.0.0, < 6.4.15
>= 7.0.0, < 7.1.8
Fixed in 5.4.47, 6.4.15 or 7.1.8, depending on the release line you run. How to fix ↓
Also tracked for
- symfony · Debian:12
The same CVE-2024-50342 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a popular PHP framework that provides a set of reusable components and a web application framework for building robust applications. The Symfony HTTP Client component is designed to facilitate HTTP requests and responses, enabling developers to interact with web services efficiently. However, a vulnerability has been identified in the NoPrivateNetworkHttpClient, which can lead to the unintended exposure of internal addresses and ports.
Vulnerability Detail
The vulnerability arises from the NoPrivateNetworkHttpClient's failure to adequately filter blocked IPs during host resolution. This oversight allows for potential internal address and port enumeration, which could be exploited by malicious actors to gain insights into the internal network structure. The issue is classified under CWE-200, indicating information exposure, and has a CVSS score of 3.1, reflecting its low severity but potential impact on network security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.3.0, < 5.4.475.4.47composer require symfony/http-client:5.4.47 -
>= 6.0.0, < 6.4.156.4.15composer require symfony/http-client:6.4.15 -
>= 7.0.0, < 7.1.87.1.8composer require symfony/http-client:7.1.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider using alternative HTTP clients or implementing additional network security measures to restrict access to internal addresses until the package can be updated.
Conclusion
The CVE-2024-50342 vulnerability in Symfony's HTTP Client poses a risk of internal address and port enumeration. It is crucial for developers using affected versions to update their packages promptly to the patched versions to ensure the security of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for symfony/http-client →
FAQ
The vulnerability allows for internal address and port enumeration through the NoPrivateNetworkHttpClient in Symfony, potentially exposing sensitive network information.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow attackers to gather information about your internal network, which could lead to further attacks or unauthorized access.
Yes, patches are available for various versions of Symfony. Ensure you update to the specified patched versions to mitigate the risk.
If immediate updates are not possible, consider implementing network security measures to limit access to internal resources as a temporary safeguard.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/http-client.
