PT-2017-3873 · Symfony · Symfony

David Bohannon · Published 2017-11-17 · Updated 2022-05-14 · CVE-2017-16654

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 2.7.38 Symfony versions prior to 2.8.31 Symfony versions prior to 3.2.14 Symfony versions prior to 3.3.13 Symfony versions prior to 3.4-BETA5 Symfony versions prior to 4.0-BETA5

Description An issue in the Intl component of Symfony allows an attacker to navigate to arbitrary directories via a dot-dot-slash attack, also known as Directory Traversal. The read() methods of bundle reader classes use a path and a locale to determine the language bundle to retrieve, with the locale argument value commonly retrieved from untrusted user input. This can be exploited by sending specially crafted requests, potentially allowing a remote attacker to disclose protected information.

Recommendations For versions prior to 2.7.38, update to version 2.7.38 or later. For versions prior to 2.8.31, update to version 2.8.31 or later. For versions prior to 3.2.14, update to version 3.2.14 or later. For versions prior to 3.3.13, update to version 3.3.13 or later. For versions prior to 3.4-BETA5, update to version 3.4-BETA5 or later. For versions prior to 4.0-BETA5, update to version 4.0-BETA5 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2019-04114

CVE-2017-16654

DLA-1707-1

DSA-4262-1

GHSA-C49R-8GJ6-768R

Affected Products

Symfony

References · 20

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/intl/CVE-2017-16654.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16654.yaml · Exploit
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1707-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-16654 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16654 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16654 · Security Note
• https://debian.org/security/2018/dsa-4262 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4262-1 · Vendor Advisory
• https://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-out-of-paths · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16654 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04114 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-16654 · Security Note
• https://ubuntu.com/security/CVE-2017-16654 · Vendor Advisory