CVE-2015-2308: Code Injection
Applications with ESI support (and SSI support as of Symfony 2.6) enabled and using the Symfony built-in reverse proxy (the Symfony\Component\HttpKernel\HttpCache class) are vulnerable to PHP code injection; a malicious user can inject PHP code that will be executed by the server.
HttpCache uses eval() to execute files in its cache when they contain ESI tags (and only when ESI is enabled). The vulnerability comes from the fact that PHP allows contents of <script language="php"> tags to be executed (and this kind of PHP tags is always available regardless of the configuration), but there were not escaped before the evaluation.
A possible exploit comes from websites also vulnerable to Cross-Site Scripting as an attacker can successfully conduct a PHP code injection attack by passing such a tag in a user submitted variable (for which proper output escaping was not applied).
Other sources
Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a language="php" attribute of a SCRIPT element.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2308?
CVE-2015-2308 has a critical severity due to the potential for PHP code injection by malicious users.
How do I fix CVE-2015-2308?
To fix CVE-2015-2308, upgrade to Symfony version 2.6.6 or later, or apply patches if available.
Which versions are affected by CVE-2015-2308?
CVE-2015-2308 affects Symfony versions from 2.0.0 up to 2.6.5.
What can happen if CVE-2015-2308 is exploited?
Exploitation of CVE-2015-2308 can lead to remote code execution on the server via injected PHP code.
Is CVE-2015-2308 specific to certain features in Symfony?
Yes, CVE-2015-2308 specifically affects applications with ESI and SSI support enabled in Symfony.