Code injection in the way Symfony implements translation caching in FrameworkBundle
The advisory, in context
When investigating issue #11093, Jeremy Derussé found a serious code injection issue in the way Symfony implements translation caching in FrameworkBundle.
-
Your Symfony application is vulnerable if you meet the following conditions:
-
You are using the Symfony translation system from FrameworkBundle (so basically if you are using Symfony full-stack -- you are not affected if you are using the Translation component with Silex for instance); You don't sanitize locales coming from a URL (any route with a _locale argument for instance):
When vulnerable, an attacker can submit a non-valid locale value that can contain some PHP code that will be executed by Symfony. That's because the locale value is dumped into a PHP file generated in the cache without being sanitized first.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 2.0.0 before 2.3.18
Fixed in 2.3.18
61 explicitly affected versions
2.0.7, v2.0.10, v2.0.12, v2.0.13, v2.0.14, v2.0.15, v2.0.16, v2.0.17, v2.0.18, v2.0.19, v2.0.20, v2.0.21, v2.0.22, v2.0.23, v2.0.24, v2.0.25, v2.0.9, v2.1.0, v2.1.1, v2.1.10, v2.1.11, v2.1.12, v2.1.13, v2.1.2, v2.1.3, v2.1.4, v2.1.5, v2.1.6, v2.1.7, v2.1.8, v2.1.9, v2.2.0, v2.2.1, v2.2.10, v2.2.11, v2.2.2, v2.2.3, v2.2.4, v2.2.5, v2.2.6, v2.2.7, v2.2.8, v2.2.9, v2.3.0, v2.3.1, v2.3.10, v2.3.11, v2.3.12, v2.3.13, v2.3.14, v2.3.15, v2.3.16, v2.3.17, v2.3.2, v2.3.3, v2.3.4, v2.3.5, v2.3.6, v2.3.7, v2.3.8, v2.3.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.3.18"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.7",
"v2.0.10",
"v2.0.12",
"v2.0.13",
"v2.0.14",
"v2.0.15",
"v2.0.16",
"v2.0.17",
"v2.0.18",
"v2.0.19",
"v2.0.20",
"v2.0.21",
"v2.0.22",
"v2.0.23",
"v2.0.24",
"v2.0.25",
"v2.0.9",
"v2.1.0",
"v2.1.1",
"v2.1.10",
"v2.1.11",
"v2.1.12",
"v2.1.13",
"v2.1.2",
"v2.1.3",
"v2.1.4",
"v2.1.5",
"v2.1.6",
"v2.1.7",
"v2.1.8",
"v2.1.9",
"v2.2.0",
"v2.2.1",
"v2.2.10",
"v2.2.11",
"v2.2.2",
"v2.2.3",
"v2.2.4",
"v2.2.5",
"v2.2.6",
"v2.2.7",
"v2.2.8",
"v2.2.9",
"v2.3.0",
"v2.3.1",
"v2.3.10",
"v2.3.11",
"v2.3.12",
"v2.3.13",
"v2.3.14",
"v2.3.15",
"v2.3.16",
"v2.3.17",
"v2.3.2",
"v2.3.3",
"v2.3.4",
"v2.3.5",
"v2.3.6",
"v2.3.7",
"v2.3.8",
"v2.3.9"
]
}From 2.4.0 before 2.4.8
Fixed in 2.4.8
8 explicitly affected versions
v2.4.0, v2.4.1, v2.4.2, v2.4.3, v2.4.4, v2.4.5, v2.4.6, v2.4.7
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.8"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.4.0",
"v2.4.1",
"v2.4.2",
"v2.4.3",
"v2.4.4",
"v2.4.5",
"v2.4.6",
"v2.4.7"
]
}From 2.5.0 before 2.5.2
Fixed in 2.5.2
2 explicitly affected versions
v2.5.0, v2.5.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.5.0",
"v2.5.1"
]
}From 2.0.0 before 2.3.19
Fixed in 2.3.19
80 explicitly affected versions
2.0.4, 2.0.5, 2.0.6, 2.0.7, v2.0.10, v2.0.11, v2.0.12, v2.0.13, v2.0.14, v2.0.15, v2.0.16, v2.0.17, v2.0.18, v2.0.19, v2.0.20, v2.0.21, v2.0.22, v2.0.23, v2.0.24, v2.0.25, v2.0.9, v2.1.0, v2.1.0-BETA1, v2.1.0-BETA2, v2.1.0-BETA3, v2.1.0-BETA4, v2.1.0-RC1, v2.1.0-RC2, v2.1.1, v2.1.10, v2.1.11, v2.1.12, v2.1.13, v2.1.2, v2.1.3, v2.1.4, v2.1.5, v2.1.6, v2.1.7, v2.1.8, v2.1.9, v2.2.0, v2.2.0-BETA1, v2.2.0-BETA2, v2.2.0-RC1, v2.2.0-RC2, v2.2.0-RC3, v2.2.1, v2.2.10, v2.2.11, v2.2.2, v2.2.3, v2.2.4, v2.2.5, v2.2.6, v2.2.7, v2.2.8, v2.2.9, v2.3.0, v2.3.0-BETA1, v2.3.0-BETA2, v2.3.0-RC1, v2.3.1, v2.3.10, v2.3.11, v2.3.12, v2.3.13, v2.3.14, v2.3.15, v2.3.16, v2.3.17, v2.3.18, v2.3.2, v2.3.3, v2.3.4, v2.3.5, v2.3.6, v2.3.7, v2.3.8, v2.3.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.3.19"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.0.4",
"2.0.5",
"2.0.6",
"2.0.7",
"v2.0.10",
"v2.0.11",
"v2.0.12",
"v2.0.13",
"v2.0.14",
"v2.0.15",
"v2.0.16",
"v2.0.17",
"v2.0.18",
"v2.0.19",
"v2.0.20",
"v2.0.21",
"v2.0.22",
"v2.0.23",
"v2.0.24",
"v2.0.25",
"v2.0.9",
"v2.1.0",
"v2.1.0-BETA1",
"v2.1.0-BETA2",
"v2.1.0-BETA3",
"v2.1.0-BETA4",
"v2.1.0-RC1",
"v2.1.0-RC2",
"v2.1.1",
"v2.1.10",
"v2.1.11",
"v2.1.12",
"v2.1.13",
"v2.1.2",
"v2.1.3",
"v2.1.4",
"v2.1.5",
"v2.1.6",
"v2.1.7",
"v2.1.8",
"v2.1.9",
"v2.2.0",
"v2.2.0-BETA1",
"v2.2.0-BETA2",
"v2.2.0-RC1",
"v2.2.0-RC2",
"v2.2.0-RC3",
"v2.2.1",
"v2.2.10",
"v2.2.11",
"v2.2.2",
"v2.2.3",
"v2.2.4",
"v2.2.5",
"v2.2.6",
"v2.2.7",
"v2.2.8",
"v2.2.9",
"v2.3.0",
"v2.3.0-BETA1",
"v2.3.0-BETA2",
"v2.3.0-RC1",
"v2.3.1",
"v2.3.10",
"v2.3.11",
"v2.3.12",
"v2.3.13",
"v2.3.14",
"v2.3.15",
"v2.3.16",
"v2.3.17",
"v2.3.18",
"v2.3.2",
"v2.3.3",
"v2.3.4",
"v2.3.5",
"v2.3.6",
"v2.3.7",
"v2.3.8",
"v2.3.9"
]
}From 2.4.0 before 2.4.9
Fixed in 2.4.9
9 explicitly affected versions
v2.4.0, v2.4.1, v2.4.2, v2.4.3, v2.4.4, v2.4.5, v2.4.6, v2.4.7, v2.4.8
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.4.0"
},
{
"fixed": "2.4.9"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.4.0",
"v2.4.1",
"v2.4.2",
"v2.4.3",
"v2.4.4",
"v2.4.5",
"v2.4.6",
"v2.4.7",
"v2.4.8"
]
}From 2.5.0 before 2.5.4
Fixed in 2.5.4
4 explicitly affected versions
v2.5.0, v2.5.1, v2.5.2, v2.5.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v2.5.0",
"v2.5.1",
"v2.5.2",
"v2.5.3"
]
}References
- https://github.com/symfony/symfony/commit/06a80fbdbe744ad6f3010479ba64ef5cf35dd9af.patch
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2014-4931.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2014-4931.yaml
- https://symfony.com/blog/security-releases-cve-2014-4931-symfony-2-3-18-2-4-8-and-2-5-2-released