Improper Handling of URL Encoding (Hex Encoding) in Sylius - #VU159501
Published: November 5, 2026
Vulnerability details
The vulnerability allows remote attackers to reach the Sylius API even when an operator has disabled it through sylius_api.enabled. The entire API remains reachable subject to its normal authentication requirements, exposing anonymous shop operations and allowing credentialed access to protected endpoints. Unexpectedly exposed functionality includes customer registration, password reset requests, cart creation, and token endpoints, enabling input submission, email generation, and credential-stuffing attempts against an API the operator believed was unavailable. API-specific rate limits, WAF rules, or monitoring may also be absent because the operator considered that surface disabled.
The vulnerability exists due to inconsistent URL decoding between the API-disable subscriber and Symfony's routing machinery. The subscriber compares the raw, undecoded path returned by Request::getPathInfo() against the configured API prefix, while Symfony decodes the path before route matching. A remote attacker can bypass the disabled-API check without credentials by percent-encoding a character in the prefix, for example requesting /api/v%32/shop/orders instead of /api/v2/shop/orders. The encoded path does not contain the literal prefix checked by the subscriber, but subsequently decodes to a valid API route and is dispatched normally. Other percent-encoded forms of the prefix produce the same mismatch.
The configuration flag only causes KernelRequestEventSubscriber to reject matching requests; it does not unregister API Platform routes, remove resources or operations, or disable firewalls. The subscriber runs before routing, when route attributes are unavailable. The flag defaults to false, and Sylius-Standard enables it only in development, so an otherwise unmodified production installation can be affected even without an explicit decision to disable the API. This is a protection-mechanism failure, not an authentication bypass: firewall and access-control path matching decode the request normally, so administrator endpoints still require administrator credentials and customer-token-protected endpoints still require a token. The separately tracked Shop API ownership-filter issue is distinct from this disabled-API bypass.