symfony · symfony
In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.
Disclosed on 2 Sep 2020. No public exploit code or confirmed exploitation is recorded.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
2 packages in 1 ecosystem. Main package: symfony/symfony.
Upgrade to 5.1.5 or later
Set the version to 5.1.5 or later in your composer.json.
The first fix for CVE-2020-15094.
| If you run | Upgrade to |
|---|---|
| 5.0.0 up to 5.1.5 | 5.1.5 |
| 4.3.0 up to 4.4.13 | 4.4.13 |
“Up to” means the second version is the fix and is not affected.
Forks, repackagings and products that include the affected code. Each has its own fixed version.