MediumGHSA-cqqh-94r6-wjrgCVE-2017-16790

Symfony SSRF Vulnerability via Form Component

Published 14 May 2022 · Updated 25 Apr 2024

Affected packages

symfony/formComposer
Affected
>=2.7.0 <2.7.38
Fixed in
2.7.38
Update to the fixed version for your release line, for example:composer require symfony/form:^2.7.38
symfony/formComposer
Affected
>=2.8.0 <2.8.31
Fixed in
2.8.31
Update to the fixed version for your release line, for example:composer require symfony/form:^2.8.31
symfony/formComposer
Affected
>=3.0.0 <3.2.14
Fixed in
3.2.14
Update to the fixed version for your release line, for example:composer require symfony/form:^3.2.14
symfony/formComposer
Affected
>=3.3.0 <3.3.13
Fixed in
3.3.13
Update to the fixed version for your release line, for example:composer require symfony/form:^3.3.13
symfony/symfonyComposer
Affected
>=2.7.0 <2.7.38
Fixed in
2.7.38
Update to the fixed version for your release line, for example:composer require symfony/symfony:^2.7.38
symfony/symfonyComposer
Affected
>=2.8.0 <2.8.31
Fixed in
2.8.31
Update to the fixed version for your release line, for example:composer require symfony/symfony:^2.8.31
symfony/symfonyComposer
Affected
>=3.0.0 <3.2.14
Fixed in
3.2.14
Update to the fixed version for your release line, for example:composer require symfony/symfony:^3.2.14
symfony/symfonyComposer
Affected
>=3.3.0 <3.3.13
Fixed in
3.3.13
Update to the fixed version for your release line, for example:composer require symfony/symfony:^3.3.13

Details

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, the request handler classes of the Form component merge POST data and uploaded files data into one array. This big array forms the data that are then bound to the form. At this stage there is no difference anymore between submitted POST data and uploaded files. A user can send a crafted HTTP request where the value of a "FileType" is sent as normal POST data that could be interpreted as a local file path on the server-side (for example, "file:///etc/passwd"). If the application did not perform any additional checks about the value submitted to the "FileType", the contents of the given file on the server could have been exposed to the attacker.

Is GHSA-cqqh-94r6-wjrg in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected symfony/form, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.