Skip to content
Fencer Intel
high 7.5

CVE-2014-4931 json

Code injection in the way Symfony implements translation caching in FrameworkBundle

published 2024-05-30 2 y ago modified 2024-05-30 2 y ago also GHSA-wfv7-5x33-v22h

cvss
7.5
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

When investigating issue [#11093](https://github.com/symfony/symfony/issues/11093), [Jeremy Derussé](https://connect.sensiolabs.com/profile/jderusse) found a serious code injection issue in the way Symfony implements translation caching in FrameworkBundle.

- Your Symfony application is vulnerable if you meet the following conditions:

- You are using the Symfony translation system from FrameworkBundle (so basically if you are using Symfony full-stack -- you are not affected if you are using the Translation component with Silex for instance); You don't sanitize locales coming from a URL (any route with a _locale argument for instance):

When vulnerable, an attacker can submit a non-valid locale value that can contain some PHP code that will be executed by Symfony. That's because the locale value is dumped into a PHP file generated in the cache without being sanitized first.

Patch / fix

  • packagist symfony/framework-bundle 2.3.18, 2.4.8, 2.5.2
  • packagist symfony/symfony 2.3.19, 2.4.9, 2.5.4

CVSS scores

assigned by version score vector
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
packagist symfony/framework-bundle
>=2.0.0, <2.3.18
>=2.4.0, <2.4.8
>=2.5.0, <2.5.2
2.3.18
2.4.8
2.5.2
packagist symfony/symfony
>=2.0.0, <2.3.19
>=2.4.0, <2.4.9
>=2.5.0, <2.5.4
2.3.19
2.4.9
2.5.4

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.