In breve
- CVE-2024-50345 è una vulnerabilità MEDIO (CVSS 6.1) che riguarda symfony/http-foundation, symfony (sensiolabs).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.59%, superiore al 48.1% delle vulnerabilità.
- Correzione: aggiornare a 6.4.14, 7.1.7, 5.4.46 o successiva.
| Package | Affected versions | Patched versions |
|---|
| symfony/http-foundation Packagist | ≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46
| 6.4.147.1.75.4.46
|
| symfony | ≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46
| 6.4.147.1.75.4.46
|
Description
Description
The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.
Resolution
The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.
NVD description
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free