PT-2020-14179 · Symfony · Symfony

Mpdude · Published 2020-09-02 · Updated 2024-03-06 · CVE-2020-15094

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 4.4.13 Symfony versions prior to 5.1.5

Description The CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind, where all HTTP calls come from a trusted backend. However, when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible.

Recommendations For Symfony versions prior to 4.4.13, update to version 4.4.13 or later. For Symfony versions prior to 5.1.5, update to version 5.1.5 or later. As a temporary workaround, consider stripping HTTP headers designed for internal use in HttpCache from remote responses before being passed to HttpCache.

Exploit

Fix

RCE

Weakness Enumeration

CWE-212

Related Identifiers

BIT-SYMFONY-2020-15094

CVE-2020-15094

GHSA-754H-5R27-7X3R

Affected Products

Symfony

References · 18

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2020-15094.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2020-15094.yaml · Exploit
• https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78 · Patch
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAQJXAKWPMWB7OL6QPG2ZSEQZYYPU5RC · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15094 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15094 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HNGUWOEETOFVH4PN3I3YO4QZHQ4AUKF3 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-15094 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-754h-5r27-7x3r · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/HNGUWOEETOFVH4PN3I3YO4QZHQ4AUKF3 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/VAQJXAKWPMWB7OL6QPG2ZSEQZYYPU5RC · Vendor Advisory
• https://osv.dev/vulnerability/BIT-symfony-2020-15094 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-15094 · Vendor Advisory
• https://github.com/symfony/symfony/security/advisories/GHSA-754h-5r27-7x3r · Note
• https://github.com/symfony/symfony · Note