Symfony vulnerable to open redirect via browser-sanitized URLs

TRUNG BÌNH 6.1CVE-2024-50345 · GHSA-mrqx-rp3w-jpjp · Công bố 06/11/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2024-50345 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng symfony/http-foundation, symfony (sensiolabs).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.59%, cao hơn 48.1% các lỗ hổng khác.
Cách xử lý: cập nhật lên 6.4.14, 7.1.7, 5.4.46 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
symfony/http-foundation Packagist	`≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46`	`6.4.147.1.75.4.46`
symfony sensiolabs	`≥ 6.0.0, < 6.4.14≥ 7.0.0, < 7.1.7< 5.4.46`	`6.4.147.1.75.4.46`

Mô tả

Description

The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.

Resolution

The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/

The patch for this issue is available here for branch 5.4.

Credits

We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.

Mô tả của NVD

symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.