Symfony Allows URI Restrictions Bypass Via Double-Encoded String
The advisory, in context
On the Symfony 2.0.x version, there's a security issue that allows access to routes protected by a firewall even when the user is not logged in.
Both the Routing component and the Security component uses the path returned by getPathInfo() to match a Request. The getPathInfo() returns a decoded path, but the Routing component (Symfony\Component\Routing\Matcher\UrlMatcher) decodes the path a second time; whereas the Security component, Symfony\Component\HttpFoundation\RequestMatcher, does not.
This difference causes Symfony 2.0 to be vulnerable to double encoding attacks.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 2.0.0 before 2.0.19
Fixed in 2.0.19
13 explicitly affected versions
2.0.4, 2.0.5, 2.0.6, 2.0.7, v2.0.10, v2.0.12, v2.0.13, v2.0.14, v2.0.15, v2.0.16, v2.0.17, v2.0.18, v2.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.19"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.4",
"2.0.5",
"2.0.6",
"2.0.7",
"v2.0.10",
"v2.0.12",
"v2.0.13",
"v2.0.14",
"v2.0.15",
"v2.0.16",
"v2.0.17",
"v2.0.18",
"v2.0.9"
]
}From 2.0.0 before 2.0.19
Fixed in 2.0.19
13 explicitly affected versions
2.0.4, 2.0.5, 2.0.6, 2.0.7, v2.0.10, v2.0.12, v2.0.13, v2.0.14, v2.0.15, v2.0.16, v2.0.17, v2.0.18, v2.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.19"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.4",
"2.0.5",
"2.0.6",
"2.0.7",
"v2.0.10",
"v2.0.12",
"v2.0.13",
"v2.0.14",
"v2.0.15",
"v2.0.16",
"v2.0.17",
"v2.0.18",
"v2.0.9"
]
}From 2.0.0 before 2.0.19
Fixed in 2.0.19
13 explicitly affected versions
2.0.4, 2.0.5, 2.0.6, 2.0.7, v2.0.10, v2.0.12, v2.0.13, v2.0.14, v2.0.15, v2.0.16, v2.0.17, v2.0.18, v2.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.19"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.4",
"2.0.5",
"2.0.6",
"2.0.7",
"v2.0.10",
"v2.0.12",
"v2.0.13",
"v2.0.14",
"v2.0.15",
"v2.0.16",
"v2.0.17",
"v2.0.18",
"v2.0.9"
]
}From 2.0.0 before 2.0.19
Fixed in 2.0.19
14 explicitly affected versions
2.0.4, 2.0.5, 2.0.6, 2.0.7, v2.0.10, v2.0.11, v2.0.12, v2.0.13, v2.0.14, v2.0.15, v2.0.16, v2.0.17, v2.0.18, v2.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.0.19"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.4",
"2.0.5",
"2.0.6",
"2.0.7",
"v2.0.10",
"v2.0.11",
"v2.0.12",
"v2.0.13",
"v2.0.14",
"v2.0.15",
"v2.0.16",
"v2.0.17",
"v2.0.18",
"v2.0.9"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2012-6431
- https://github.com/symfony/symfony/commit/55014a6841bec50046e8329a4835c160ac31a496
- https://github.com/symfony/symfony/commit/8b2c17f80377582287a78e0b521497e039dd6b0d
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2012-6431.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/routing/CVE-2012-6431.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2012-6431.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2012-6431.yaml
- https://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released
- http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released