Reflected XSS via Unescaped Default Parameter in Symfony JsonRulePrinter with POC

Reflected XSS via unescaped default parameter in JsonRulePrinter Vulnerability Overview Vulnerability Type: Reflected Cross-Site Scripting (Reflected XSS) Root Cause: The class fails to escape the parameter during output, allowing attackers to inject malicious scripts. Trigger Condition: When the parameter contains malicious content such as tags, it is directly rendered into the HTML and executed. Affected Component: The method within . Affected Scope Affected Versions: - Symfony Validator Component < 3.3.1 - Symfony Framework < 2.8.3 Affected Environments: - Web applications using to output validation error messages - Projects where output escaping is not enabled by default configuration Remediation Official Fix: Upgrade to Symfony Validator ≥ 3.3.1 or Symfony Framework ≥ 2.8.3 Temporary Mitigation: - Manually perform HTML escaping on the parameter before output - Disable or switch to other secure output methods Recommended Configuration: POC Code Exploitation Chain 1. Attacker constructs a parameter containing malicious scripts 2. Submits it via form input or URL parameters 3. Backend uses to output validation errors 4. Browser parses and executes the malicious script Bypass Evidence Even if is enabled, the vulnerability may still be bypassed if the parameter is not handled correctly Some framework default configurations do not enable output escaping, leaving the vulnerability exploitable Recommended Fixes Upgrade Symfony to a secure version Add additional escaping logic at the output layer Review all code paths utilizing

Goal Reached Thanks to every supporter — we hit 100%!

Reflected XSS via Unescaped Default Parameter in Symfony JsonRulePrinter with POC

More from this source