GHSA-754h-5r27-7x3r
Suggest an improvement- Source
- https://github.com/advisories/GHSA-754h-5r27-7x3r
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-754h-5r27-7x3r/GHSA-754h-5r27-7x3r.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-754h-5r27-7x3r
- Aliases
- Published
- 2020-09-02T17:29:56Z
- Modified
- 2024-02-15T05:33:34.082713Z
- Severity
-
- 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- RCE in Symfony
- Details
-
Description
The
CachingHttpClientclass from the HttpClient Symfony component relies on theHttpCacheclass to handle requests.HttpCacheuses internal headers likeX-Body-EvalandX-Body-Fileto control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used byCachingHttpClientand if an attacker can control the response for a request being made by theCachingHttpClient, remote code execution is possible.Resolution
HTTP headers designed for internal use in
HttpCacheare now stripped from remote responses before being passed toHttpCache.The patch for this issue is available here for the 4.4 branch.
Credits
I would like to thank Matthias Pigulla (webfactory GmbH) for reporting and fixing the issue.
- Database specific
{ "nvd_published_at": "2020-09-02T18:15:00Z", "cwe_ids": [ "CWE-212" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2020-09-02T17:29:29Z" }- References
-
- https://github.com/symfony/symfony/security/advisories/GHSA-754h-5r27-7x3r
- https://nvd.nist.gov/vuln/detail/CVE-2020-15094
- https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2020-15094.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2020-15094.yaml
- https://github.com/symfony/symfony
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HNGUWOEETOFVH4PN3I3YO4QZHQ4AUKF3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VAQJXAKWPMWB7OL6QPG2ZSEQZYYPU5RC
- https://packagist.org/packages/symfony/http-kernel
- https://packagist.org/packages/symfony/symfony
- https://symfony.com/cve-2020-15094
Affected packages
Packagist / symfony/http-kernel
Package
- Name
- symfony/http-kernel
- Purl
- pkg:composer/symfony/http-kernel
Packagist / symfony/http-kernel
Package
- Name
- symfony/http-kernel
- Purl
- pkg:composer/symfony/http-kernel
Packagist / symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony/symfony
Packagist / symfony/symfony
Package
- Name
- symfony/symfony
- Purl
- pkg:composer/symfony/symfony