PT-2024-10554 · Symfony · Symfony Frameworkbundle

Published 2024-05-30 · Updated 2024-05-30 · CVE-2014-4931

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symfony FrameworkBundle (affected versions not specified)

Description A code injection issue was found in the way Symfony implements translation caching in FrameworkBundle. The issue arises when using the Symfony translation system and not sanitizing locales coming from a URL. An attacker can submit a non-valid locale value containing PHP code that will be executed by Symfony, as the locale value is dumped into a PHP file generated in the cache without being sanitized first.

Recommendations For Symfony FrameworkBundle, ensure that locales coming from URLs are properly sanitized to prevent code injection. As a temporary workaround, consider validating and filtering all locale values passed through routes with a locale argument to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2014-4931

GHSA-WFV7-5X33-V22H

Affected Products

Symfony Frameworkbundle

References · 5

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2014-4931.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2014-4931.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-wfv7-5x33-v22h · Vendor Advisory
• https://github.com/symfony/symfony/commit/06a80fbdbe744ad6f3010479ba64ef5cf35dd9af.patch · Note
• https://symfony.com/blog/security-releases-cve-2014-4931-symfony-2-3-18-2-4-8-and-2-5-2-released · Note