PT-2018-2798 · Symfony · Symfony

David Gorges · Published 2018-12-06 · Updated 2022-05-14 · CVE-2018-19789

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions 2.7.x through 2.7.49 Symfony versions 2.8.x through 2.8.48 Symfony versions 3.x through 3.4.19 Symfony versions 4.0.x through 4.0.14 Symfony versions 4.1.x through 4.1.8 Symfony versions 4.2.x through 4.2.0

Description An issue in Symfony allows for the disclosure of the path of an uploaded file when using the scalar type hint string in a setter method of a class that's the data class of a form, and a file upload is submitted instead of a normal text input. This could potentially escalate to a Remote Code Execution issue when combined with a local file inclusion issue in certain circumstances. The vulnerability is related to unrestricted file uploads of dangerous types, which can be exploited by a remote attacker to execute arbitrary code or disclose protected information.

Recommendations For Symfony versions 2.7.x through 2.7.49, update to version 2.7.50 or later. For Symfony versions 2.8.x through 2.8.48, update to version 2.8.49 or later. For Symfony versions 3.x through 3.4.19, update to version 3.4.20 or later. For Symfony versions 4.0.x through 4.0.14, update to version 4.0.15 or later. For Symfony versions 4.1.x through 4.1.8, update to version 4.1.9 or later. For Symfony versions 4.2.x through 4.2.0, update to version 4.2.1 or later.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2019-01956

CVE-2018-19789

DLA-1707-1

DSA-4441-1

GHSA-X3CF-W64X-4CP2

Affected Products

Symfony

References · 29

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/form/CVE-2018-19789.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-19789.yaml · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-19789 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-19789 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-19789 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1707-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/JZMRJ7VTHCY5AZK24G4QGX36RLUDTDKE · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=57444186 · Vendor Advisory
• https://symfony.com/blog/cve-2018-19789-disclosure-of-uploaded-files-full-path · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZMRJ7VTHCY5AZK24G4QGX36RLUDTDKE · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-19789 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4TD3E7FZIXLVFG3SMFJPDEKPZ26TJOW7 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-19789 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19789 · Security Note
• https://osv.dev/vulnerability/GHSA-x3cf-w64x-4cp2 · Vendor Advisory