CVE-2024-50345: Open redirect via browser-sanitized URLs
Description
The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain.
Resolution
The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/
The patch for this issue is available here for branch 5.4.
Credits
We would like to thank Sam Mush - IPASSLab && ZGC Lab for reporting the issue and Nicolas Grekas for providing the fix.
Other sources
CVE-2024-50345: Open redirect via browser-sanitized URLs
— Packagist
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The Request class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the Request class to redirect users to another domain. The Request::create methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/symfony/http-foundationto a version that resolves this vulnerability.Fixed in 7.1.7 - Upgrade
Upgrade
composer/symfony/http-foundationto a version that resolves this vulnerability.Fixed in 6.4.14 - Upgrade
Upgrade
composer/symfony/http-foundationto a version that resolves this vulnerability.Fixed in 5.4.46 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 5.4.46 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 6.4.14 - Upgrade
Upgrade
composer/symfony/symfonyto a version that resolves this vulnerability.Fixed in 7.1.7 - Upgrade
Upgrade
debian/symfonyto a version that resolves this vulnerability.Fixed in 5.4.23+dfsg-1+deb12u3 - Upgrade
Upgrade
debian/symfonyto a version that resolves this vulnerability.Fixed in 6.4.14+dfsg-1 - Upgrade
Upgrade
debian/symfonyto a version that resolves this vulnerability.Fixed in 5.4.53+dfsg-0+deb12u1Fixed in 6.4.41+dfsg-0+deb13u1Fixed in 6.4.49+dfsg-0+deb13u1Fixed in 7.4.22+dfsg-1Fixed in 7.4.23+dfsg-1 - Upgrade
Upgrade
symfony/http-foundationto a version that resolves this vulnerability.Fixed in 5.4.46 - Upgrade
Upgrade
symfony/http-foundationto a version that resolves this vulnerability.Fixed in 6.4.14 - Upgrade
Upgrade
symfony/http-foundationto a version that resolves this vulnerability.Fixed in 7.1.7
Event History
Frequently Asked Questions
What is the severity of CVE-2024-50345?
The severity of CVE-2024-50345 is considered high due to the potential for attackers to manipulate redirects.
How do I fix CVE-2024-50345?
To fix CVE-2024-50345, update the symfony/http-foundation package to version 7.1.7, 6.4.14, or 5.4.46 depending on your current installation.
Which versions of symfony/http-foundation are affected by CVE-2024-50345?
Versions of symfony/http-foundation from 5.0.0 to 5.4.45, from 6.0.0 to 6.4.13, and from 7.0.0 to 7.1.6 are affected by CVE-2024-50345.
What type of vulnerability is CVE-2024-50345 classified as?
CVE-2024-50345 is classified as a URI manipulation vulnerability.
What can an attacker gain by exploiting CVE-2024-50345?
An attacker exploiting CVE-2024-50345 can redirect users to malicious domains by tricking a validator relying on the Request class.