Symfony Incorrect Access Control
Impact
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 2.3.19 before 2.3.29Ecosystem versions | 2.3.29 |
| From 2.5.4 before 2.5.12Ecosystem versions | 2.5.12 |
| From 2.6.0 before 2.6.8Ecosystem versions | 2.6.8 |
| From 2.4.9 through 2.4.10 (inclusive)Ecosystem versions | Not recorded |
Version evidence: OSV · GHSA-qmqw-mpqp-mr54
View original version evidence (28 explicit versions)
| Affected range | Recorded fix |
|---|---|
| From 2.3.19 before 2.3.29Ecosystem versions | 2.3.29 |
| From 2.4.9 through 2.4.10 (inclusive)Ecosystem versions | Not recorded |
| From 2.5.4 before 2.5.12Ecosystem versions | 2.5.12 |
| From 2.6.0 before 2.6.8Ecosystem versions | 2.6.8 |
Version evidence: OSV · GHSA-qmqw-mpqp-mr54
View original version evidence (28 explicit versions)
Original source description
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
This issue has been fixed in Symfony 2.3.29, 2.5.12, and 2.6.8. Note that no fixes are provided for Symfony 2.4 as it's not maintained anymore.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2015-4050
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2015-4050.yaml
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-4050.yaml
- Security advisory symfony.com/cve-2015-4050
- Security advisory web.archive.org/web/20200228090443/http://www.securityfocus.com/bid/74928
- Source reference lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html
- Source reference lists.fedoraproject.org/pipermail/package-announce/2015-June/159603.html
- Source reference lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html
- Security advisory symfony.com/blog/cve-2015-4050-esi-unauthorized-access
- Security advisory www.debian.org/security/2015/dsa-3276