PT-2024-10559 · Symfony · Symfony Webprofiler

Published

2024-05-30

·

Updated

2024-05-30

·

CVE-2014-6072

CVSS v3.1

8.1

High

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Symfony WebProfiler bundle versions 2.0.X through 2.5.X
Description The Symfony Web Profiler, a development tool, should not be enabled on production servers due to the sensitive information it provides about a Symfony project. If enabled in production, it must be properly secured. The import/export feature of the web profiler is exploitable, even when secured, as it is not protected against CSRF attacks and uses PHP serialized strings, making the application vulnerable to code injection.
Recommendations For Symfony 2.3, update to version 2.3.19 and use the profiler:import and profiler:export Symfony commands from the command line interface by adding the necessary code snippet to app/console. For Symfony 2.4 and 2.5, update to versions 2.4.9 and 2.5.4 respectively, and import the commands in your app/config.yml configuration file to use the profiler:import and profiler:export Symfony commands. For Symfony 2.0, 2.1, and 2.2, no fixes are provided as they are not maintained anymore. As a general recommendation, never enable the Symfony Web Profiler on production servers, and if it must be enabled, ensure it is properly secured.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2014-6072
GHSA-V35G-4RRW-H4FW

Affected Products

Symfony Webprofiler