Support for legacy HTTP methods in Symfony - CVE-2018-14773
Published: August 1, 2018
Vulnerability identifier: #VU14165
CSH Severity: Low
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-14773
CWE-ID: CWE-749
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to Symfony HttpFoundation component includes support for legacy Microsoft IIS headers X-Original-URL and X-Rewrite-URL. A remote attacker can send a specially crafted HTTP request to the vulnerable application requesting one URL but have Symphony return a different one. An attacker can abuse X-Original-URL and X-Rewrite-URL headers to access otherwise restricted functionality and bypass restrictions on higher level caches and web servers.
Affected software
Symfony
Drupal
symfony (Debian package)
Drupal
symfony (Debian package)
How to mitigate CVE-2018-14773
The vulnerability is fixed in Symfony 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, and 4.1.3.
Symfony - addressed in versions 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, 4.1.3
symfony (Debian package) - update to 2.8.7+dfsg-1.3+deb9u2
Drupal - update to 8.5.6
symfony (Debian package) - update to 2.8.7+dfsg-1.3+deb9u2
Drupal - update to 8.5.6