Symfony vulnerable to open redirect via browser-sanitized URLs

中 6.1CVE-2024-50345 · GHSA-mrqx-rp3w-jpjp · 06/11/2024 公開 · 17/06/2026 更新

要点

CVE-2024-50345 は symfony/http-foundation, symfony (sensiolabs) に影響する深刻度「中」 (CVSS 6.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.59%（全脆弱性の 48.1% より高い）。
対処：6.4.14, 7.1.7, 5.4.46 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
symfony/http-foundation Packagist	`≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46`	`6.4.147.1.75.4.46`
symfony sensiolabs	`≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46`	`6.4.147.1.75.4.46`

概要

Description

The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.

Resolution

The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.

NVD の説明

symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.