Em resumo
- CVE-2024-50345 é uma vulnerabilidade MÉDIO (CVSS 6.1) que afeta symfony/http-foundation, symfony (sensiolabs).
- Chance de exploração nos próximos 30 dias (EPSS): 0.59%, maior que 48.1% das vulnerabilidades.
- Correção: atualize para 6.4.14, 7.1.7, 5.4.46 ou posterior.
| Package | Affected versions | Patched versions |
|---|
| symfony/http-foundation Packagist | ≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46
| 6.4.147.1.75.4.46
|
| symfony | ≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46
| 6.4.147.1.75.4.46
|
Description
Description
The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.
Resolution
The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.
NVD description
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Mais vulnerabilidades de symfony/http-foundation
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free