PT-2018-2797 · Symfony · Symfony

James Kettle · Publicado 2018-07-14 · Atualizado 2022-05-13 · CVE-2018-14773

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions 2.7.0 through 2.7.48 Symfony versions 2.8.0 through 2.8.43 Symfony versions 3.3.0 through 3.3.17 Symfony versions 3.4.0 through 3.4.13 Symfony versions 4.0.0 through 4.0.13 Symfony versions 4.1.0 through 4.1.2

Description The issue arises from the support for a legacy IIS header that allows users to override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. This can be exploited by a remote attacker to impact the integrity of protected data. The vulnerability affects the SymfonyComponentHttpFoundationRequest::prepareRequestUri() function, where X-Original-URL and X REWRITE URL are used. The exploitation of this issue can lead to web cache poisoning.

Recommendations For Symfony versions 2.7.0 through 2.7.48, update to a version that drops support for the X-Original-URL and X-Rewrite-URL methods. For Symfony versions 2.8.0 through 2.8.43, update to a version that drops support for the X-Original-URL and X-Rewrite-URL methods. For Symfony versions 3.3.0 through 3.3.17, update to a version that drops support for the X-Original-URL and X-Rewrite-URL methods. For Symfony versions 3.4.0 through 3.4.13, update to a version that drops support for the X-Original-URL and X-Rewrite-URL methods. For Symfony versions 4.0.0 through 4.0.13, update to a version that drops support for the X-Original-URL and X-Rewrite-URL methods. For Symfony versions 4.1.0 through 4.1.2, update to a version that drops support for the X-Original-URL and X-Rewrite-URL methods. As a temporary workaround, consider disabling the use of the X-Original-URL and X-Rewrite-URL headers in the prepareRequestUri() function until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-349

CWE-19

Identificadores relacionados

BDU:2019-01955

CVE-2018-14773

DLA-1707-1

DSA-4441-1

GHSA-8WGJ-6WX8-H5HQ

Produtos afetados

Symfony

Referências · 51

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-14773.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2018-14773.yaml · Exploit
• https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b · Correção
• https://bdu.fstec.ru/vul/2019-04246 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10909 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19790 · Nota de Segurança
• http://securityfocus.com/bid/104943 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-14773 · Aviso do Fabricante
• https://drupal.org/SA-CORE-2018-005 · Correção
• https://bdu.fstec.ru/vul/2019-01955 · Nota de Segurança
• https://osv.dev/vulnerability/DLA-1707-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-4441-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10913 · Nota de Segurança
• https://seclists.org/bugtraq/2019/May/21 · Nota
• https://osv.dev/vulnerability/GHSA-8wgj-6wx8-h5hq · Aviso do Fabricante