PT-2024-10555 · Symfony · Symfony Httpfoundation

Published 2024-05-30 · Updated 2024-05-30 · CVE-2014-5244

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Symfony HttpFoundation component versions 2.0.X through 2.5.X

Description This issue allows for a Denial of Service (DoS) attack when an arbitrarily long hostname is sent by a client. The parsing of the hostname in the Request::getHost() function can be exploited due to the way the hostname is validated via a regular expression.

Recommendations For versions 2.3.X, update to version 2.3.19 or later. For versions 2.4.X, update to version 2.4.9 or later. For versions 2.5.X, update to version 2.5.4 or later. For versions 2.0.X, 2.1.X, and 2.2.X, no fixes are provided as these versions are not maintained anymore. As a temporary workaround for these versions, consider modifying the regular expression used to parse and validate the hostname to avoid too much sensitivity to the submitted value length.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2014-5244

GHSA-V77V-X634-9M56

Affected Products

Symfony Httpfoundation

References · 7

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2014-5244.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2014-5244.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-v77v-x634-9m56 · Vendor Advisory
• https://github.com/symfony/symfony/pull/11828 · Note
• https://github.com/symfony/symfony/commit/1ee96a8b1b0987ffe2a62dca7ad268bf9edfa9b8 · Note
• https://symfony.com/cve-2014-5244 · Note
• https://symfony.com/blog/cve-2014-5244-denial-of-service-with-a-malicious-http-host-header · Note