CVE-2012-6431: Medium severity symfony vulnerability
On the Symfony 2.0.x version, there's a security issue that allows access to routes protected by a firewall even when the user is not logged in.
Both the Routing component and the Security component uses the path returned by getPathInfo() to match a Request. The getPathInfo() returns a decoded path, but the Routing component (Symfony\Component\Routing\Matcher\UrlMatcher) decodes the path a second time; whereas the Security component, Symfony\Component\HttpFoundation\RequestMatcher, does not.
This difference causes Symfony 2.0 to be vulnerable to double encoding attacks.
Other sources
Routes behind a firewall are accessible even when not logged in
Symfony 2.0.x before 2.0.20 does not process URL encoded data consistently within the Routing and Security components, which allows remote attackers to bypass intended URI restrictions via a doubly encoded string.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6431?
CVE-2012-6431 has been assigned a medium severity rating as it allows unauthorized access to protected routes.
How do I fix CVE-2012-6431?
To mitigate CVE-2012-6431, upgrade Symfony to version 2.0.20 or later.
What versions are affected by CVE-2012-6431?
CVE-2012-6431 affects Symfony versions from 2.0.0 to 2.0.19.
What components are impacted by CVE-2012-6431?
CVE-2012-6431 impacts the Routing component and the Security component of Symfony.
Can CVE-2012-6431 be exploited remotely?
Yes, CVE-2012-6431 can be exploited remotely, allowing unauthorized access without user login.