symfony/ux-live-component: XSS via attacker-controlled child component tag
The advisory, in context
Description
Symfony\UX\LiveComponent\Util\ChildComponentPartialRenderer::createHtml() interpolates the $childTag argument directly into the HTML output as a tag name, without escaping or validation. The value originates from client-controlled JSON (children[id].tag) parsed by LiveComponentSubscriber and propagated through InterceptChildComponentRenderSubscriber, so an attacker who can reach the Live Component endpoint can inject arbitrary HTML, including <script> tags, on any re-render of a Live Component that contains at least one child component.
In the default configuration, the Live Component endpoint is gated by an Accept: application/vnd.live-component+html request-header check that cannot be set cross-origin without a CORS preflight, so the issue is primarily a defense-in-depth gap. It becomes directly exploitable on applications that have relaxed CORS to allow this header from untrusted origins, or that have been pivoted from another same-origin XSS.
Resolution
ChildComponentPartialRenderer now validates $childTag against a strict HTML tag-name regex before interpolating it, and rejects any value that doesn't match. Anything that wouldn't be a valid HTML tag is dropped before reaching the response.
The patch for this issue is available here for branch 2.x (and forward-ported to 3.x).
Credits
Symfony would like to thank Pascal Cescon for reporting the issue and Hugo Alliaume for providing the fix.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 2.8.0 before 2.36.0
Fixed in 2.36.0
47 explicitly affected versions
v2.10.0, v2.11.0, v2.11.1, v2.11.2, v2.12.0, v2.13.0, v2.13.1, v2.13.2, v2.13.3, v2.14.0, v2.14.1, v2.14.2, v2.15.0, v2.16.0, v2.17.0, v2.18.0, v2.18.1, v2.19.0, v2.19.2, v2.20.0, v2.21.0, v2.22.0, v2.22.1, v2.23.0, v2.24.0, v2.25.0, v2.25.1, v2.25.2, v2.26.0, v2.26.1, v2.27.0, v2.28.0, v2.28.1, v2.28.2, v2.29.0, v2.29.1, v2.29.2, v2.30.0, v2.31.0, v2.32.0, v2.33.0, v2.34.0, v2.35.0, v2.8.0, v2.8.1, v2.9.0, v2.9.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.36.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.10.0",
"v2.11.0",
"v2.11.1",
"v2.11.2",
"v2.12.0",
"v2.13.0",
"v2.13.1",
"v2.13.2",
"v2.13.3",
"v2.14.0",
"v2.14.1",
"v2.14.2",
"v2.15.0",
"v2.16.0",
"v2.17.0",
"v2.18.0",
"v2.18.1",
"v2.19.0",
"v2.19.2",
"v2.20.0",
"v2.21.0",
"v2.22.0",
"v2.22.1",
"v2.23.0",
"v2.24.0",
"v2.25.0",
"v2.25.1",
"v2.25.2",
"v2.26.0",
"v2.26.1",
"v2.27.0",
"v2.28.0",
"v2.28.1",
"v2.28.2",
"v2.29.0",
"v2.29.1",
"v2.29.2",
"v2.30.0",
"v2.31.0",
"v2.32.0",
"v2.33.0",
"v2.34.0",
"v2.35.0",
"v2.8.0",
"v2.8.1",
"v2.9.0",
"v2.9.1"
]
}From 3.0.0 before 3.1.0
Fixed in 3.1.0
1 explicitly affected versions
v3.0.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v3.0.0"
]
}