CVE-2020-15094 RCE in Symfony
Attackers can achieve remote code execution in Symfony applications using CachingHttpClient if they control the response of a cached request.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-15094?
CVE-2020-15094 is a high-severity code injection vulnerability in Fedoraproject Fedora, published on 2 Sep 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.
Weakness: CWE-212
Which versions are affected by CVE-2020-15094?
9 open source packages ship an affected version, including symfony/http-kernel, symfony and symfony/symfony. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
symfony/http-kernel Packagist | From 4.3.0 | 4.4.13 |
symfony/http-kernel Packagist | From 4.3.0 | 4.4.13 |
symfony/http-kernel Packagist | From 5.0.0 | 5.1.5 |
symfony/http-kernel Packagist | From 5.0.0 | 5.1.5 |
symfony Bitnami | From 4.4.0 | 4.4.13, 5.1.5 |
symfony/symfony Packagist | From 4.3.0 | 4.4.13 |
3 more packages
symfony/symfony Packagist | From 4.3.0 | 4.4.13 |
symfony/symfony Packagist | From 5.0.0 | 5.1.5 |
symfony/symfony Packagist | From 5.0.0 | 5.1.5 |
Products include Fedoraproject Fedora, Sensiolabs Httpclient, Sensiolabs Symfony.
How do I fix CVE-2020-15094?
Upgrade symfony/http-kernel to a fixed version for your release line: 4.4.13 or 5.1.5.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-15094 being exploited?
There is no known exploitation of CVE-2020-15094 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as BIT-symfony-2020-15094, DEBIAN-CVE-2020-15094, GHSA-754h-5r27-7x3r.