Symfony vulnerabilities

The attemptAuthentication function in Symfony before versions 2.3.41, 2.7.13, 2.8.6, and 3.0.6 does not limit the length of a username stored in a session. This allows remote attackers to cause a denial of service through a series of authentication attempts with long, non-existent usernames.

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library, and the openssl_random_pseudo_bytes function fails.

Symfony versions 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x are vulnerable to remote attacks that allow arbitrary PHP code execution via a serialized PHP object in the Yaml::parse or Yaml\Parser::parse functions.

The Yaml::parse function in Symfony 2.0.x before version 2.0.22 allows remote attackers to execute arbitrary PHP code via a PHP file, which is a different vulnerability than CVE-2013-1397.

A vulnerability in Symfony allows an attacker to manipulate the APP_ENV and APP_DEBUG environment variables via a crafted query string that bypasses the protection introduced in CVE-2024-50340. The issue stems from a discrepancy between parse_str() and the web SAPI, enabling attacker-controlled --env or --no-debug flags to be passed to the script.

In Symfony up to versions 6.4.40, 7.4.12, and 8.0.12, the OidcTokenHandler::verifyClaims() method registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(). This allowed a validly signed JWT missing those claims to pass verification.

A vulnerability in Symfony X509Authenticator allows an attacker with a trusted certificate to impersonate a victim by placing emailAddress= in another RDN value, such as CN, due to an unanchored regex.

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.

A vulnerability in Symfony allows an attacker to manipulate URL paths via controlled route parameters. The UrlGenerator::doGenerate() function uses strtr() dot-segment encoding that skips every other chained ../ or ./ segment, enabling generation of URLs that collapse to a different path under RFC 3986 normalization.

In Symfony PHP framework from 6.1.0 to 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs bypassed sanitization, allowing javascript: payloads. Fixed in versions 6.4.41, 7.4.13, and 8.0.13.

A vulnerability in Symfony allows bypassing URL sanitization via percent-encoded BiDi formatting characters, enabling visual-spoofing character injection. Affects versions from 6.1.0 to 6.4.41, 7.4.13, and 8.0.13.

A vulnerability in Symfony allows an attacker to downgrade the Mailomat webhook signature algorithm from SHA-256 to a weaker one by manipulating the X-MOM-Webhook-Signature header. The issue affects MailomatRequestParser::validateSignature() before versions 7.4.13 and 8.0.13.

A vulnerability in Symfony affects NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS by omitting IPv6 transition prefixes (such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6). This allows attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block.

A vulnerability in Symfony allows an unauthenticated attacker, via a failed login request with a _failure_path parameter, to dispatch a subrequest to protected GET routes while bypassing firewall listeners. This occurs when failure_forward: true is enabled.

A vulnerability in Symfony allows an attacker to inject forged Twilio status payloads by bypassing the X-Twilio-Signature HMAC header verification. The TwilioRequestParser::doParse() method ignores the configured webhook secret, enabling unauthenticated POST requests.

A vulnerability in Symfony allows XML External Entity (XXE) injection when processing XML via the Crawler::addXmlContent() method. Setting DOMDocument::$validateOnParse = true before loadXML() re-enables external entity resolution, allowing an attacker to read local files using file:// entities.

A vulnerability in Symfony SendmailTransport in -t mode appends recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address starting with - to be interpreted as a sendmail option. Fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

A vulnerability in Symfony's MailtrapRequestParser::doParse() ignores the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. Affects versions prior to 7.4.12 and 8.0.12.

Symfony prior to versions 6.4.40, 7.4.12, and 8.0.12 has a vulnerability in the Mailjet and LOX24 bridges where webhooks do not verify configured secrets, allowing unauthenticated POST requests with forged payloads.

A vulnerability in Symfony, versions from 6.1.0-BETA1 to 6.4.40, 7.4.12, and 8.0.12, occurs because UrlAttributeSanitizer::getSupportedAttributes() omits URL-valued attributes (action, formaction, poster, cite). Configurations that allow these attributes may leave javascript: URIs unsanitized, enabling XSS when the resulting HTML is rendered or a victim interacts with a form or button.

A vulnerability in the Yaml component of the Symfony framework allows a ReDoS (Regular Expression Denial of Service) attack via crafted YAML input. The `cleanup()` method in the `Parser` class uses regular expressions with overlapping quantifiers, which can cause parsing to hang for an arbitrarily long time.

A vulnerability in the Symfony Yaml component allows a YAML bomb attack via recursive expansion of collection aliases. A small untrusted YAML input can be expanded into a multi-gigabyte structure, exhausting memory.

A vulnerability in Symfony allows a DoS attack via deeply nested YAML structures. The lack of recursion depth limit in the parser causes PHP stack exhaustion and worker crash.

In Symfony prior to 7.4.12 and 8.0.12, method-scoped #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] attributes configured for GET only are skipped for HEAD requests, allowing protected controllers to execute and potentially leak headers or perform side effects.

A vulnerability in Symfony's PdoAdapter allows an attacker to manipulate a DELETE statement by improperly handling the prefix. The lack of proper binding or escaping enables altering query semantics and deletion scope.

A stored XSS vulnerability in Symfony's development profiler file_excerpt Twig filter interpolates lines from non-PHP files directly into <code> elements. Affects versions from 6.4.24 to 6.4.40, 7.4.12, and 8.0.12.

A vulnerability in Symfony allows email header injection due to improper validation of parameter names in the ParameterizedHeader class. An attacker can pass untrusted input containing CRLF characters, enabling the addition of extra headers to messages.

Symfony from 6.1.0-BETA1 to 6.4.40, 7.4.12, and 8.0.12 has a vulnerability in UrlSanitizer::parse() that passes Unicode BiDi formatting characters into sanitized href and src attributes. This allows a link to visually differ from its actual destination, enabling phishing.

A vulnerability in the JsonPath component of the Symfony framework allows an attacker to perform a DoS attack by sending a specially crafted pattern to the match() and search() methods. The pattern is compiled directly into preg_match() without length limits, enabling catastrophic backtracking expressions to exhaust CPU resources.

A vulnerability in Symfony ServerLogCommand allows remote attackers to execute PHP code via deserialization of unchecked data. The server listens on port 9911 and deserializes received frames without authentication or class validation.

A vulnerability in Symfony (versions 7.1.0 to 7.4.12 and 8.0.12) allows an attacker to hijack a victim's authentication session by manipulating the Host header when framework.trusted_hosts is not configured. An attacker controlling another application registered with the same CAS server can replay the victim's ticket and authenticate as the victim.

A vulnerability in the Symfony Address component allows injection of email headers or SMTP commands via a specially crafted email address with a quoted local part containing newline characters. The Address constructor did not reject addresses containing CRLF, enabling an attacker to manipulate message content or the SMTP protocol.

A vulnerability in Symfony HtmlSanitizer allows bypassing the allowed host list due to differences in URL parsing between RFC 3986 and WHATWG, and incorrect checking of the <area href> tag against the media policy instead of the link policy. Affects versions from 6.1.0-BETA1 to 6.4.40, 7.4.12, and 8.0.12.

In Symfony prior to versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $, allowing values like //evil.com to satisfy a locale requirement and generate a protocol-relative off-site URL.

In Symfony from versions 2.0.0, 5.0.0, and 6.0.0 up to 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but do not actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony escapes the output of the affected filters.