Vulnerability · Published Sep 2, 2020 · Assigned by GitHub_M
CVE-2020-15094RCE in Symfony
High 8.0
In plain English
A high-severity security flaw in symfony from symfony. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | symfony | 4.4.13+dfsg-1 | DEBIAN-CVE-2020-15094 |
| Debian:13 | symfony | 4.4.13+dfsg-1 | DEBIAN-CVE-2020-15094 |
| Debian:14 | symfony | 4.4.13+dfsg-1 | DEBIAN-CVE-2020-15094 |
| Packagist | symfony/http-kernel | 5.1.5 | GHSA-754h-5r27-7x3r |
| Packagist | symfony/http-kernel | 4.4.13 | GHSA-754h-5r27-7x3r |
| Packagist | symfony/symfony | 5.1.5 | GHSA-754h-5r27-7x3r |
| Packagist | symfony/symfony | 4.4.13 | GHSA-754h-5r27-7x3r |
Affected products (as reported)
Weakness: CWE-212 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
References
- https://github.com/symfony/symfony/security/advisories/GHSA-754h-5r27-7x3r x_refsource_CONFIRM
- https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78 x_refsource_MISC
- https://packagist.org/packages/symfony/symfony x_refsource_MISC
- https://packagist.org/packages/symfony/http-kernel x_refsource_MISC
- FEDORA-2020-16eb328853 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-1c549262f1 vendor-advisory, x_refsource_FEDORA