Symfony v8.0.12 Security Bulletin: Multiple CVEs (XSS, XXE, RBAC Bypass)

Vulnerability Overview The webpage screenshot displays the release notes for Symfony v8.0.12, which contains multiple security-related fixes and improvements. The main vulnerabilities addressed include: 1. CVE-2024-50340: Fixes a runtime vulnerability by bypassing parameters on . 2. CVE-2024-46626: Rejects webhooks with missing or invalid tokens. 3. CVE-2024-45754: Rejects webhooks with missing or invalid tokens. 4. CVE-2024-47212: Rejects webhooks with missing or invalid HMAC signatures. 5. CVE-2024-45753: Cleans , , , and attributes in URLs. 6. CVE-2024-45754: Rejects webhooks with missing or invalid Basic credentials. 7. CVE-2024-45072: Fixes an XSS issue in . 8. CVE-2024-45064: Rejects BIDI override characters and percent-encoded spaces in URLs. 9. CVE-2024-45066: Fixes / misclassification due to URL parser differences and tag issues. 10. CVE-2024-45069: Adds missing claims in . 11. CVE-2024-45071: Fixes an XXE issue in DomCrawler by disabling in . 12. CVE-2024-45068: Rejects addresses starting with a hyphen in SendmailTransport. 13. CVE-2024-45063: Fixes the regular expression anchor in X509Authenticator from the RDN boundary. 14. CVE-2024-45065: Fixes routing regular expression alternation anchoring in UrlGenerator. 15. CVE-2024-45067: Rejects addresses containing line breaks. 16. CVE-2024-45073: Validates prefixes to clean up AbstractAdapter::clear. 17. CVE-2024-45077: Localizes the sender log by default for MailerMailgun. 18. CVE-2024-45755: Rejects webhooks with missing or invalid HMAC signatures. 19. CVE-2024-45756: Prevents regular expression backtracking in / . 20. CVE-2024-45074: Requires configuration of trusted hosts when using CAS authentication. 21. CVE-2024-45075: Fixes an issue in HttpKernel where HEAD requests bypass the , , and checks. Scope of Impact These vulnerabilities affect multiple components of the Symfony framework, including but not limited to: Runtime: Vulnerability involving bypassing parameters on . Notifier: Rejects webhooks with missing or invalid tokens or HMAC signatures. HtmlSanitizer: Cleans , , , and attributes in URLs; rejects BIDI override characters and percent-encoded spaces in URLs; fixes / misclassification due to URL parser differences and tag issues. Mailer: Rejects webhooks with missing or invalid Basic credentials; rejects addresses starting with a hyphen; localizes MailerMailgun sender logs by default; rejects webhooks with missing or invalid HMAC signatures. TwigBridge: Fixes XSS issue in . HttpKernel: Fixes bypass of , , and checks via HEAD requests. DomCrawler: Fixes XXE issues. Routing: Fixes routing regular expression alternation anchoring. Mime: Rejects addresses containing line breaks. Cache: Validates prefixes to clean up AbstractAdapter::clear. UserPassword: Prevents regular expression backtracking in / . Security: Requires configuration of trusted hosts when using CAS authentication. Remediation All the aforementioned vulnerabilities have been addressed via corresponding patches. Specific remediation measures include: Stricter validation of parameters on . Stricter validation of tokens and HMAC signatures for webhooks. Cleaning , , , and attributes in URLs. Rejecting BIDI override characters and percent-encoded spaces in URLs. Fixing / misclassification due to URL parser differences and tag issues. Adding missing claims in . Disabling in . Rejecting addresses starting with a hyphen in SendmailTransport. Fixing the regular expression anchor in X509Authenticator from the RDN boundary. Fixing routing regular expression alternation anchoring in UrlGenerator. Rejecting addresses containing line breaks. Validating prefixes to clean up AbstractAdapter::clear. Localizing MailerMailgun sender logs by default. Rejecting webhooks with missing or invalid HMAC signatures. Preventing regular expression backtracking in / . Requiring configuration of trusted hosts when using CAS authentication. Fixing bypass of , , and checks in HttpKernel via HEAD requests. POC Code or Exploit Code No specific POC code or exploit code is provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

Symfony v8.0.12 Security Bulletin: Multiple CVEs (XSS, XXE, RBAC Bypass)

More from this source