← Back to CVEs

CVE-2020-15094

HIGH

8.0

Description

In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.

CVE Details

CVSS v3.1 Score8.0

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredLOW

User InteractionREQUIRED

Published9/2/2020

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

fedoraproject:fedorasensiolabs:httpclientsensiolabs:symfony

Weaknesses (CWE)

CWE-212

References

https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78(security-advisories@github.com)

https://github.com/symfony/symfony/security/advisories/GHSA-754h-5r27-7x3r(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HNGUWOEETOFVH4PN3I3YO4QZHQ4AUKF3/(security-advisories@github.com)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAQJXAKWPMWB7OL6QPG2ZSEQZYYPU5RC/(security-advisories@github.com)

https://packagist.org/packages/symfony/http-kernel(security-advisories@github.com)

https://packagist.org/packages/symfony/symfony(security-advisories@github.com)

https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/symfony/symfony/security/advisories/GHSA-754h-5r27-7x3r(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HNGUWOEETOFVH4PN3I3YO4QZHQ4AUKF3/(af854a3a-2127-422b-91ae-364da2661108)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAQJXAKWPMWB7OL6QPG2ZSEQZYYPU5RC/(af854a3a-2127-422b-91ae-364da2661108)

https://packagist.org/packages/symfony/http-kernel(af854a3a-2127-422b-91ae-364da2661108)

https://packagist.org/packages/symfony/symfony(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.