Local File Exposure Vulnerability in Symfony Package
Summary
CVE-2017-16790: An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. Affects symfony across 9 version ranges.
< 3.4.0+dfsg-1
>= 5a7e31c48e7cd4831efa409fffb661beb9995174, <= 1452970fc29131776505f684bd81d7a33cbaada4
>= 5615b92cd452cd54f1433a3f53de87c096a1107f, <= 628af9253369a8d5a42525386edd28b757d93695
>= 9975b1eca3de4db792a2c3e4e16f676a4aadcd46, <= c166da413153ecbb4b83c0415f7df13c250c3342
>= 760872233cd3147870184697e3481ffa492ac2fb, <= a5c3f701b864a2bb1d6b71b859afd3efe3b9e43d
>= a8d5dd00894f8b5e3edb897f4504c51ddc442370, <= c03861cc34bba4a36be756a3456334165ba6a98c
>= a6209fac5e5984ba49d8b5a1af5e5c118a1c183e, <= 4fe1764b69b5e7e0d74656b5214a9026313e23ab
>= b96a144bc875684f3338f697687147a2696d73eb, <= e1aabd6f50fb4586b330f9ac54b4bcdf7352a0f8
>= de2f3d51160791ef254010953dbde178fee9845f, <= e23595473a10892462e61443f07d19210ab505af
Fixed in 3.4.0+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a robust PHP framework used for building web applications. It provides reusable components and a structured architecture that enhances the development process. However, certain versions of Symfony are vulnerable to a local file exposure issue, which can lead to unauthorized access to sensitive server files.
Vulnerability Detail
An issue was discovered in Symfony versions prior to 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a user submits a form, the Form component merges POST data and uploaded files into a single array. This can allow an attacker to craft an HTTP request where a 'FileType' value is sent as normal POST data, potentially interpreted as a local file path on the server (e.g., 'file:///etc/passwd'). If the application does not validate this input, it could expose sensitive file contents to the attacker.
How To Fix
Minimum fixed version
3.4.0+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade symfonyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation on the server-side to ensure that any file paths submitted through the form are checked against a whitelist of acceptable values. For example:
if (preg_match('/^/allowed/path/.*$/', $filePath)) {
// Process the file
} else {
// Reject the request
}
Conclusion
The local file exposure vulnerability in Symfony poses a significant risk to applications using affected versions. It is crucial to update to a secure version and implement proper input validation to mitigate potential risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for symfony →
FAQ
Symfony versions before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5 are affected.
If your application is vulnerable, an attacker could potentially access sensitive files on your server, leading to data breaches or further exploitation.
You can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
The CVSS score of this vulnerability is 6.5, indicating a medium severity level.
Yes, you can implement input validation and sanitization as a temporary workaround, but updating to a secure version is strongly recommended.
Related vulnerabilities
Recent vulnerabilities recorded for symfony.
