CVE-2020-15143 Remote Code Execution in SyliusResourceBundle
Attackers can achieve remote code execution by injecting malicious expressions into request parameters processed by the SyliusResourceBundle.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15143?
CVE-2020-15143 is a high-severity code injection vulnerability in SyliusResourceBundle, published on 19 Aug 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In SyliusResourceBundle before versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4, rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution. This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.
Which versions are affected by CVE-2020-15143?
8 open source packages ship an affected version, including sylius/resource-bundle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sylius/resource-bundle Packagist | From 1.0.0 | 1.3.14 |
sylius/resource-bundle Packagist | From 1.0.0 | 1.3.14 |
sylius/resource-bundle Packagist | From 1.4.0 | 1.4.7 |
sylius/resource-bundle Packagist | From 1.4.0 | 1.4.7 |
sylius/resource-bundle Packagist | From 1.5.0 | 1.5.2 |
sylius/resource-bundle Packagist | From 1.5.0 | 1.5.2 |
2 more packages
sylius/resource-bundle Packagist | From 1.6.0 | 1.6.4 |
sylius/resource-bundle Packagist | From 1.6.0 | 1.6.4 |
Products include Sylius Syliusresourcebundle.
How do I fix CVE-2020-15143?
Upgrade sylius/resource-bundle to a fixed version for your release line: 1.3.14, 1.4.7, 1.5.2 or 1.6.4.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-15143 being exploited?
There is no known exploitation of CVE-2020-15143 in the wild and no public exploit code.
Other vulnerabilities in SyliusResourceBundle
Sources
Also known as GHSA-p4pj-9g59-4ppv.