Symfony XML Entity Expansion security vulnerability in symfony/symfony
Summary
GHSA-q2gc-gg3x-7942: Symfony XML Entity Expansion security vulnerability. Affects symfony/symfony versions >= 2.0.0, < 2.0.17. Fixed in 2.0.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a popular PHP framework that provides a set of reusable components and tools for building web applications. It is widely used for its flexibility, scalability, and robustness. However, the Symfony framework is vulnerable to an XML Entity Expansion (XEE) attack, which can lead to Denial of Service (DoS) attacks against the host's RAM. This vulnerability affects versions 2.0.0 to 2.0.17 of the symfony/symfony package.
Vulnerability Detail
The vulnerability arises from the lack of a method to disable custom entities in PHP, specifically within the XML document without using external entities. This allows an attacker to define a long entity and refer to it multiple times in document elements, causing a memory sink and enabling DoS attacks. The impact of this vulnerability is amplified when the LIBXML_NOENT or equivalent option is used in a dependent extension. The libxml2 library's defense against related XEE attacks is only active if the LIBXML_PARSEHUGE option is not set. This vulnerability has a CVSS score of 7.5 (High).
How To Fix
Minimum fixed version
2.0.17
This is the first release that contains the fix.
composer require symfony/symfony:2.0.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A possible workaround for this vulnerability is to remove the DOCTYPE declaration from the XML document instead of rejecting the XML outright. However, this may result in other issues with unresolved entities.
Conclusion
The Symfony XML Entity Expansion security vulnerability in the symfony/symfony package exposes systems to potential Denial of Service attacks. It is crucial to upgrade to a non-affected version and implement the recommended defense mechanisms to mitigate the risk. For further assistance and information, please reach out to DevNack.com.
See every vulnerability recorded for symfony/symfony →
FAQ
The vulnerability allows an attacker to mount Denial of Service (DoS) attacks against the host's RAM, potentially causing system instability or downtime.
Versions 2.0.0 to 2.0.17 of the symfony/symfony package are affected by this vulnerability.
Upgrading to a version of symfony/symfony that is not affected by this issue (2.0.18 or higher) and implementing the recommended defense mechanisms can mitigate the risk of exploitation.
Yes, this vulnerability has a CVSS score of 7.5 (High).
For more information, you can refer to the vulnerability details on Vulert (https://vulert.com/scanner) or contact info@devnack.com for further support.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/symfony.
