CVE-2019-11325 Improper Input Validation in Symfony
Attackers can execute arbitrary PHP code via specially crafted strings due to incorrect escaping in the Symfony VarExport component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-11325?
CVE-2019-11325 is a critical code injection vulnerability in Sensiolabs Symfony, published on 21 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
Weakness: CWE-116
Which versions are affected by CVE-2019-11325?
8 open source packages ship an affected version, including symfony/symfony and symfony/var-exporter. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
symfony/symfony Packagist | From 4.2.0 | 4.2.12 |
symfony/symfony Packagist | From 4.2.0 | 4.2.12 |
symfony/symfony Packagist | From 4.3.0 | 4.3.8 |
symfony/symfony Packagist | From 4.3.0 | 4.3.8 |
symfony/var-exporter Packagist | From 4.2.0 | 4.2.12 |
symfony/var-exporter Packagist | From 4.2.0 | 4.2.12 |
2 more packages
symfony/var-exporter Packagist | From 4.3.0 | 4.3.8 |
symfony/var-exporter Packagist | From 4.3.0 | 4.3.8 |
Products include Sensiolabs Symfony.
How do I fix CVE-2019-11325?
Upgrade symfony/symfony to a fixed version for your release line: 4.2.12 or 4.3.8.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-11325 being exploited?
There is no known exploitation of CVE-2019-11325 in the wild and no public exploit code.
Other vulnerabilities in Sensiolabs Symfony
- CVE-2017-11365 Symfony Incorrect Access Control
- CVE-2019-10913 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
- CVE-2018-11407 Symfony Authentication Bypass
- CVE-2016-2403 Symfony Authentication Bypass
- CVE-2026-45063 Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator
Sources
Also known as DEBIAN-CVE-2019-11325, GHSA-w4rc-rx25-8m86.