Symfony2 Security Issue: Trust Proxy Mode Enabled
Summary
GHSA-vfm6-r2gc-pwww: Symfony2 security issue when the trust proxy mode is enabled. Affects symfony/http-foundation across 2 version ranges.
>= 2.0.0, < 2.0.19
>= 2.1.0, < 2.1.4
Fixed in 2.0.19 or 2.1.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony2 is a popular PHP framework that provides a set of reusable components and tools for building web applications. The Symfony HttpFoundation component, used by Symfony2, provides an object-oriented layer for the HTTP protocol. It includes classes for handling requests, responses, sessions, cookies, and more. However, a security vulnerability has been discovered when the trust proxy mode is enabled in Symfony2.
Vulnerability Detail
The vulnerability arises when an application uses the client IP address returned by the Request::getClientIp() method for sensitive decisions, such as IP-based access control. This can lead to potential security breaches if the client IP address is not properly validated or trusted. An attacker could manipulate the IP address and bypass IP-based access controls, gaining unauthorized access to sensitive resources or performing malicious actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.0.192.0.19composer require symfony/http-foundation:2.0.19 -
>= 2.1.0, < 2.1.42.1.4composer require symfony/http-foundation:2.1.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you are unable to upgrade or apply the patches immediately, you can temporarily mitigate the vulnerability by manually validating and trusting the client IP address in your application code. This can be done by checking the client IP against a list of trusted IP addresses or using a trusted reverse proxy. However, this workaround is not recommended as it may introduce additional complexity and potential security risks.
Conclusion
The Symfony2 security issue when the trust proxy mode is enabled can lead to unauthorized access and potential security breaches. It is crucial for Symfony2 users to upgrade to the latest version or apply the provided patches to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for symfony/http-foundation →
FAQ
The vulnerability allows attackers to bypass IP-based access controls and gain unauthorized access to sensitive resources or perform malicious actions.
The vulnerability affects all versions of Symfony2 up to and including 2.0.19 and 2.1.4.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your composer.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this Symfony2 security issue.
Yes, Symfony2 has released patches for versions 2.0.19 and 2.1.4. It is recommended to upgrade to the latest version of Symfony2 to fix the vulnerability.
If upgrading or patching is not possible immediately, you can manually validate and trust the client IP address in your application code as a temporary workaround. However, it is strongly advised to upgrade or apply the patches as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/http-foundation.
