CVE-2020-15143 High · 7.7 EPSS 1.9%

Remote Code Execution in SyliusResourceBundle

Sylius · SyliusResourceBundle

Official description · CVE.org

In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

Breakdown

21.4 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 3/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

How attackers get in
- Get in through VPN or remote-access servicesT1133 · External Remote ServicesSource data20 general detection rules
What they do
- Run commands on the systemT1059 · Command and Scripting InterpreterSource data95 general detection rules

Disclosed on 19 Aug 2020. No public exploit code or confirmed exploitation is recorded.

3 fixes in sylius/resource-bundle over 7 months. The latest fix listed for sylius/resource-bundle is 1.6.4.

Fixes in sylius/resource-bundlePackagist package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

1.6.3CVE-2020-522027 Jan 2020
1.6.4CVE-2020-1514319 Aug 2020
1.6.4CVE-2020-1514619 Aug 2020Latest listed

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

External Remote Services T1133 also Persistence

MITRE CTID mapping of the CVE · how it is exploited

ExecutionTA0002

Command and Scripting Interpreter T1059

MITRE CTID mapping of the CVE · primary impact

Detection

0 rules for this CVE · 115 general rules for its techniques

Rules for this CVE

0 that reference CVE-2020-15143 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

External Remote ServicesT113320 general rules

External Remote SMB Logon from Public IPhightest
OpenCanary - SSH Login Attempthightest
OpenCanary - SSH New Connection Attempthightest
OpenCanary - Telnet Login Attempthightest
Running Chrome VPN Extensions via the Registry 2 VPN Extensionhightest
Unusual Child Process of dns.exehightest
Unusual File Deletion by Dns.exehightest
Unusual File Modification by dns.exehightest

All 20 on SigmaHQ ↗

Command and Scripting InterpreterT105995 general rules

HackTool - Sliver C2 Implant Activity Patterncriticaltest
Lazarus Group Activitycriticaltest
REvil Kaseya Incident Malware Patternscriticaltest
Turla Group Lateral Movementcriticaltest
Windows Defender AMSI Trigger Detectedhighstable
Windows Defender Threat Detectedhighstable
Abusable DLL Potential Sideloading From Suspicious Locationhightest
Add Insecure Download Source To Wingethightest

All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: sylius/resource-bundle.

Packagistsylius/resource-bundleGHSA-p4pj-9g59-4ppv

Upgrade to 1.6.4 or later

Fixes this CVE and 1 other known vulnerability in this package (CVE-2020-5220).

Set the version to 1.6.4 or later in your composer.json.

The first fix for CVE-2020-15143.

Affected versions, by release line

If you run	Upgrade to
1.6.0 up to 1.6.4	1.6.4
1.5.0 up to 1.5.2	1.5.2
1.4.0 up to 1.4.7	1.4.7
1.0.0 up to 1.3.14	1.3.14

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

1 link, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppv

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2020-0636

No public exploit code found.

, 30 Oct 2026

1.9%Top 20%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 79.8%).

3.1

7.7High · 7.7

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.7981 16.0/20

Threat reports0 reports 0.0/10

Public exploit codenone found 0.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scorebase score 7.7 5.4/7

End-of-life productsupported or unknown 0.0

Total21.4

Record

Published: 19 Aug 2020
Modified: 4 Aug 2024
: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
Elsewhere: NVD CVE.org JSON

How an attack unfolds

1How attackers get in

2What they do

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.