File Disclosure Vulnerability in endroid/qr-code-bundle
Summary
GHSA-mvf6-3f2g-xfxf: endroid/qr-code-bundle File Disclosure via logo_path query parameter. Affects endroid/qr-code-bundle versions < 3.4.2. Fixed in 3.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The endroid/qr-code-bundle is a package available on Packagist that provides functionality for generating QR codes in Symfony applications. It allows developers to easily create QR codes with various customization options. However, versions prior to 3.4.2 are vulnerable to a security issue that can lead to file disclosure.
Vulnerability Detail
The vulnerability in endroid/qr-code-bundle arises from the improper handling of non-image data as the logo. This can be exploited by an attacker who can manipulate the logo_path query parameter to disclose arbitrary files on the server. By providing a non-image file path, an attacker can trick the application into returning the contents of the file, potentially exposing sensitive information. This vulnerability has a moderate severity rating and is identified with the CWE-200 code.
How To Fix
Minimum fixed version
3.4.2
This is the first release that contains the fix.
composer require endroid/qr-code-bundle:3.4.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by upgrading to the latest version of endroid/qr-code-bundle.
Conclusion
The file disclosure vulnerability in endroid/qr-code-bundle can be mitigated by upgrading to version 3.4.2 or later. It is crucial to apply this fix to prevent potential file disclosure and protect sensitive information. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for endroid/qr-code-bundle →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it to identify any vulnerable packages.
Exploiting this vulnerability can lead to the disclosure of sensitive files on the server. This could include configuration files, database credentials, or other sensitive information, depending on the files accessible to the application.
There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to apply the fix promptly to mitigate the risk of potential exploitation.
No additional configuration is required after upgrading to version 3.4.2 or later. The fix addresses the vulnerability, and the package should function as expected.
For more information about this vulnerability, you can refer to the advisory on the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-mvf6-3f2g-xfxf/GHSA-mvf6-3f2g-xfxf.json
