In short
- CVE-2024-50345 is a MEDIUM (CVSS 6.1) vulnerability affecting symfony/http-foundation, symfony (sensiolabs).
- Chance of exploitation in the next 30 days (EPSS): 0.59%, higher than 48.1% of all vulnerabilities.
- Fix: update to 6.4.14, 7.1.7, 5.4.46 or later.
| Package | Affected versions | Patched versions |
|---|
| symfony/http-foundation Packagist | ≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46
| 6.4.147.1.75.4.46
|
| symfony | ≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46
| 6.4.147.1.75.4.46
|
Description
Description
The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.
Resolution
The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.
NVD description
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
More vulnerabilities in symfony/http-foundation
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free