Symfony/Validator XML Entity Expansion Vulnerability
Summary
GHSA-4vf2-qfg3-7598: symfony/validator XML Entity Expansion vulnerability. Affects symfony/validator versions >= 2.0.0, < 2.0.17. Fixed in 2.0.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony/Validator is a component of the Symfony framework that provides a set of tools for validating data. It is widely used in PHP applications to ensure the integrity and validity of user input. However, a vulnerability has been discovered in versions 2.0.0 to 2.0.17 of Symfony/Validator that allows for XML Entity Expansion (XEE) attacks. This vulnerability arises from a lack of defense against XEE Quadratic Blowup Attacks in extensions using libxml2. XEE attacks can lead to Denial of Service (DoS) attacks by consuming excessive amounts of memory, potentially causing the host system to crash.
Vulnerability Detail
The vulnerability in Symfony/Validator arises from the inability to disable custom entities in PHP, allowing for the exploitation of XEE Quadratic Blowup Attacks. By defining a long entity and referring to it multiple times in document elements, an attacker can create a memory sink that rapidly consumes the host's RAM. This vulnerability is amplified when the LIBXML_NOENT or equivalent option is used in a dependent extension. Additionally, libxml2's defense against Exponential or Billion Laugh's XEE attacks is disabled when the LIBXML_PARSEHUGE option is set. The impact of this vulnerability can be severe, leading to DoS attacks and potential system crashes.
How To Fix
Minimum fixed version
2.0.17
This is the first release that contains the fix.
composer require symfony/validator:2.0.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A workaround for this vulnerability is to call the libxml_disable_entity_loader(TRUE) function and, optionally, use the LIBXML_NONET option to disable local filesystem access. However, this workaround may result in unresolved entities and other potential issues with the XML document.
Conclusion
The Symfony/Validator XML Entity Expansion vulnerability in versions 2.0.0 to 2.0.17 can lead to Denial of Service (DoS) attacks by consuming excessive amounts of memory. It is recommended to upgrade to the latest version of Symfony/Validator or apply the provided patch to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for symfony/validator →
FAQ
Symfony/Validator is a component of the Symfony framework that provides tools for validating data in PHP applications.
Versions 2.0.0 to 2.0.17 of Symfony/Validator are affected by this vulnerability.
XML Entity Expansion (XEE) attack is a type of attack where an attacker exploits the ability to define and refer to entities in an XML document to consume excessive amounts of memory, leading to Denial of Service (DoS) attacks.
This vulnerability can lead to Denial of Service (DoS) attacks by consuming excessive amounts of memory, potentially causing system crashes.
To mitigate this vulnerability, it is recommended to upgrade to the latest version of Symfony/Validator or apply the provided patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/validator.
