{"id":"GHSA-wfv7-5x33-v22h","aliases":["CVE-2014-4931"],"title":"Code injection in the way Symfony implements translation caching in FrameworkBundle","description":"When investigating issue [#11093](https://github.com/symfony/symfony/issues/11093), [Jeremy Derussé](https://connect.sensiolabs.com/profile/jderusse) found a serious code injection issue in the way Symfony implements translation caching in FrameworkBundle.\n\n- Your Symfony application is vulnerable if you meet the following conditions:\n\n- You are using the Symfony translation system from FrameworkBundle (so basically if you are using Symfony full-stack -- you are not affected if you are using the Translation component with Silex for instance);\nYou don't sanitize locales coming from a URL (any route with a _locale argument for instance):\n\nWhen vulnerable, an attacker can submit a non-valid locale value that can contain some PHP code that will be executed by Symfony. That's because the locale value is dumped into a PHP file generated in the cache without being sanitized first.","severity":"high","score":7.5,"published":"2024-05-30T00:21:25.000Z","modified":"2024-05-30T00:41:45.562Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"symfony/framework-bundle","ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.3.18"}],"type":"ECOSYSTEM"}],"versions":["2.0.7","v2.0.10","v2.0.12","v2.0.13","v2.0.14","v2.0.15","v2.0.16","v2.0.17","v2.0.18","v2.0.19","v2.0.20","v2.0.21","v2.0.22","v2.0.23","v2.0.24","v2.0.25","v2.0.9","v2.1.0","v2.1.1","v2.1.10","v2.1.11","v2.1.12","v2.1.13","v2.1.2","v2.1.3","v2.1.4","v2.1.5","v2.1.6","v2.1.7","v2.1.8","v2.1.9","v2.2.0","v2.2.1","v2.2.10","v2.2.11","v2.2.2","v2.2.3","v2.2.4","v2.2.5","v2.2.6","v2.2.7","v2.2.8","v2.2.9","v2.3.0","v2.3.1","v2.3.10","v2.3.11","v2.3.12","v2.3.13","v2.3.14","v2.3.15","v2.3.16","v2.3.17","v2.3.2","v2.3.3","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9"],"fixed":["2.3.18"]},{"ecosystem":"Packagist","name":"symfony/framework-bundle","ranges":[{"events":[{"introduced":"2.4.0"},{"fixed":"2.4.8"}],"type":"ECOSYSTEM"}],"versions":["v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7"],"fixed":["2.4.8"]},{"ecosystem":"Packagist","name":"symfony/framework-bundle","ranges":[{"events":[{"introduced":"2.5.0"},{"fixed":"2.5.2"}],"type":"ECOSYSTEM"}],"versions":["v2.5.0","v2.5.1"],"fixed":["2.5.2"]},{"ecosystem":"Packagist","name":"symfony/symfony","ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.3.19"}],"type":"ECOSYSTEM"}],"versions":["2.0.4","2.0.5","2.0.6","2.0.7","v2.0.10","v2.0.11","v2.0.12","v2.0.13","v2.0.14","v2.0.15","v2.0.16","v2.0.17","v2.0.18","v2.0.19","v2.0.20","v2.0.21","v2.0.22","v2.0.23","v2.0.24","v2.0.25","v2.0.9","v2.1.0","v2.1.0-BETA1","v2.1.0-BETA2","v2.1.0-BETA3","v2.1.0-BETA4","v2.1.0-RC1","v2.1.0-RC2","v2.1.1","v2.1.10","v2.1.11","v2.1.12","v2.1.13","v2.1.2","v2.1.3","v2.1.4","v2.1.5","v2.1.6","v2.1.7","v2.1.8","v2.1.9","v2.2.0","v2.2.0-BETA1","v2.2.0-BETA2","v2.2.0-RC1","v2.2.0-RC2","v2.2.0-RC3","v2.2.1","v2.2.10","v2.2.11","v2.2.2","v2.2.3","v2.2.4","v2.2.5","v2.2.6","v2.2.7","v2.2.8","v2.2.9","v2.3.0","v2.3.0-BETA1","v2.3.0-BETA2","v2.3.0-RC1","v2.3.1","v2.3.10","v2.3.11","v2.3.12","v2.3.13","v2.3.14","v2.3.15","v2.3.16","v2.3.17","v2.3.18","v2.3.2","v2.3.3","v2.3.4","v2.3.5","v2.3.6","v2.3.7","v2.3.8","v2.3.9"],"fixed":["2.3.19"]},{"ecosystem":"Packagist","name":"symfony/symfony","ranges":[{"events":[{"introduced":"2.4.0"},{"fixed":"2.4.9"}],"type":"ECOSYSTEM"}],"versions":["v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.4.4","v2.4.5","v2.4.6","v2.4.7","v2.4.8"],"fixed":["2.4.9"]},{"ecosystem":"Packagist","name":"symfony/symfony","ranges":[{"events":[{"introduced":"2.5.0"},{"fixed":"2.5.4"}],"type":"ECOSYSTEM"}],"versions":["v2.5.0","v2.5.1","v2.5.2","v2.5.3"],"fixed":["2.5.4"]}],"references":["https://github.com/symfony/symfony/commit/06a80fbdbe744ad6f3010479ba64ef5cf35dd9af.patch","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2014-4931.yaml","https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2014-4931.yaml","https://symfony.com/blog/security-releases-cve-2014-4931-symfony-2-3-18-2-4-8-and-2-5-2-released"],"sources":[{"name":"OSV","id":"GHSA-wfv7-5x33-v22h","modified":"2024-05-30T00:41:45.562928Z","url":"https://osv.dev/vulnerability/GHSA-wfv7-5x33-v22h"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5}]}