PT-2024-40474 · Symfony · Symfony2

Published 2024-05-30 · Updated 2024-05-30

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Symfony2 versions prior to the introduction of the fix

Description The issue arises when an application relies on the client IP address returned by the Request::getClientIp() method for making sensitive decisions, such as IP-based access control. This can be exploited due to the trust proxy mode. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited. Technical details include the use of the Request::getClientIp() method and the Request::trustProxyData() method, which has been deprecated in favor of Request::setTrustedProxies(). The Request::setTrustedProxies() method takes an array of trusted proxy IP addresses as its argument.

Recommendations For all versions of Symfony2, upgrade to the latest version as soon as possible. Alternatively, apply the provided patches:

• For Symfony 2.0.19, apply the patch from https://github.com/symfony/symfony/compare/fc89d6b...9ce892c.patch
• For Symfony 2.1.4, apply the patch from https://github.com/symfony/symfony/compare/922c201...e5536f0.patch As a temporary workaround, consider using the Request::setTrustedProxies() method instead of Request::trustProxyData() to enable the trust proxy mode.

Related Identifiers

GHSA-VFM6-R2GC-PWWW

Affected Products

Symfony2

References · 7

• https://osv.dev/vulnerability/GHSA-vfm6-r2gc-pwww · Vendor Advisory
• https://github.com/symfony/symfony/commit/e5536f0fe10421da7ebbe0071343e94d039dfb97 · Note
• https://github.com/symfony/symfony/commit/9ce892cf4395e73b136e9b5cd1fae9e91995c93b · Note
• https://github.com/symfony/http-foundation/commit/5cde5229fc71a19cef2a0a933a18e08e43252f34 · Note
• https://github.com/symfony/http-foundation/commit/795ac45c188ee2a729db4513e9dfd30b16a0ed35 · Note
• https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/2012-11-29.yaml · Note
• https://symfony.com/blog/security-release-symfony-2-0-19-and-2-1-4 · Note