PT-2024-40336 · Symfony2 · Symfony2

Published 2024-05-30 · Updated 2024-05-30

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Symfony2 versions prior to the fixed version

Description A security issue was found in the Request::getClientIp() method when the trust proxy mode is enabled. This issue affects applications that use the client IP address for sensitive decisions like IP-based access control. The problem arises from the trust proxy mode being enabled, which can lead to incorrect client IP addresses being used.

Recommendations To fix this issue, use the new Request::setTrustedProxies() method instead of Request::trustProxyData() to enable the trust proxy mode, passing an array of trusted proxy IP addresses as its argument. For example: Request::setTrustedProxies(array('1.1.1.1')); where '1.1.1.1' is the IP address of a trusted reverse proxy. Apply the provided patches for Symfony 2.0.19 or Symfony 2.1.4 if an upgrade to the latest version is not feasible at this time.

Fix

Weakness Enumeration

CWE-291

Related Identifiers

GHSA-HX53-JCHX-CR52

Affected Products

Symfony2

References · 6

• https://osv.dev/vulnerability/GHSA-hx53-jchx-cr52 · Vendor Advisory
• https://github.com/symfony/symfony · Note
• https://github.com/symfony/symfony/commit/922c2015f61a7205180d423dce1f7365cc2d8460 · Note
• https://github.com/symfony/symfony/commit/9ce892cf4395e73b136e9b5cd1fae9e91995c93b · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/2012-11-29.yaml · Note
• https://symfony.com/blog/security-release-symfony-2-0-19-and-2-1-4 · Note