GHSA-2xf4-cg6j-vhgqlow2.7

symfony/polyfill-intl-idn: xn-- labels with ASCII-only Punycode payloads are treated as equivalent to their decoded form

The advisory, in context

Description

symfony/polyfill-intl-idn provides a userland implementation of idn_to_utf8() and idn_to_ascii() for runtimes that lack the intl extension. Its Idn::process() method decodes labels prefixed with xn-- using Punycode but never enforces the validity criterion added in UTS #46 revision 33 Section 4 step 4.1.2: after a successful Punycode decode, the result must contain at least one non-ASCII code point.

As a consequence, xn-- labels whose Punycode payload is empty (xn--) or decodes to a string made of only ASCII code points (e.g. xn--kc1zs4-) are accepted by the polyfill while PHP's native ext-intl rejects them with IDNA_ERROR_INVALID_ACE_LABEL. Originally unequal domain names are therefore regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing and server-side request forgery (similar to CVE-2024-12224).

Example with IDNA_USE_STD3_RULES | IDNA_CHECK_BIDI | IDNA_CHECK_CONTEXTJ | IDNA_NONTRANSITIONAL_TO_ASCII:

Input	Polyfill output	Native `ext-intl` output
`poc.xn--kc1zs4-.com`	`poc.kc1zs4.com`	`false` (`errors=1024`)
`poc.kc1zs4.xn--`	`poc.kc1zs4.`	`false` (`errors=1024`)

Applications using the polyfill to canonicalise or compare hostnames inherit the inconsistency.

Resolution

Idn::process() now records IDNA_ERROR_INVALID_ACE_LABEL when a Punycode payload decodes to an empty string or to a string containing only ASCII code points, matching the native ext-intl behaviour and UTS #46 revision 33.

The patch for this issue is available here for branch 1.x.

Credits

Symfony would like to thank Nazy Mad for reporting the issue and Nicolas Grekas for providing the fix.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

symfony/polyfill Packagist

Ecosystem versions

From 1.17.1 before 1.38.1

Fixed in 1.38.1

24 explicitly affected versions

v1.17.1, v1.18.0, v1.18.1, v1.19.0, v1.20.0, v1.22.0, v1.22.1, v1.23.0, v1.23.1, v1.24.0, v1.25.0, v1.26.0, v1.27.0, v1.28.0, v1.29.0, v1.30.0, v1.31.0, v1.32.0, v1.33.0, v1.34.0, v1.35.0, v1.36.0, v1.37.0, v1.38.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.17.1"
        },
        {
          "fixed": "1.38.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v1.17.1",
    "v1.18.0",
    "v1.18.1",
    "v1.19.0",
    "v1.20.0",
    "v1.22.0",
    "v1.22.1",
    "v1.23.0",
    "v1.23.1",
    "v1.24.0",
    "v1.25.0",
    "v1.26.0",
    "v1.27.0",
    "v1.28.0",
    "v1.29.0",
    "v1.30.0",
    "v1.31.0",
    "v1.32.0",
    "v1.33.0",
    "v1.34.0",
    "v1.35.0",
    "v1.36.0",
    "v1.37.0",
    "v1.38.0"
  ]
}

symfony/polyfill-intl-idn Packagist

Ecosystem versions

From 1.17.1 before 1.38.1

Fixed in 1.38.1

22 explicitly affected versions

v1.17.1, v1.18.0, v1.18.1, v1.19.0, v1.20.0, v1.22.0, v1.22.1, v1.23.0, v1.24.0, v1.25.0, v1.26.0, v1.27.0, v1.28.0, v1.29.0, v1.30.0, v1.31.0, v1.32.0, v1.33.0, v1.34.0, v1.35.0, v1.36.0, v1.37.0