CVE-2018-14774: Symfony Host Header Injection
An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 4.1.3 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 4.0.14 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 3.4.14 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 3.3.18 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 2.8.44 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 2.7.49
Event History
Frequently Asked Questions
What is the severity of CVE-2018-14774?
The severity of CVE-2018-14774 is high with a severity value of 7.2.
How does CVE-2018-14774 affect Symfony?
CVE-2018-14774 affects Symfony versions 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2.
What is the remedy for CVE-2018-14774?
The remedy for CVE-2018-14774 is to upgrade Symfony to version 4.1.3, 4.0.14, 3.4.14, 3.3.18, 2.8.44, or 2.7.49.
What is the issue in CVE-2018-14774?
The issue in CVE-2018-14774 is the implicit trust of X-Forwarded-Host headers when using HttpCache in Symfony.
Where can I find more information about CVE-2018-14774?
More information about CVE-2018-14774 can be found at the following references: [NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-14774), [GitHub](https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a), [Symfony Blog](https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache)