CVE-2024-50343 Incorrect response from Validator when input ends with `\n` in symfony/validator
Attackers can bypass regex validation rules ending with $ by appending newlines, requiring specific validator configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50343?
CVE-2024-50343 is a low-severity vulnerability in symfony, published on 6 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metacharacters, with an input ending with `\n`. Symfony as of versions 5.4.43, 6.4.11, and 7.1.4 now uses the `D` regex modifier to match the entire input. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-20
Which versions are affected by CVE-2024-50343?
12 open source packages ship an affected version, including symfony/symfony and symfony/validator.
| Package | Affected | Fixed in |
|---|---|---|
symfony/symfony Packagist | All versions | 5.4.43 |
symfony/symfony Packagist | All versions | 5.4.43 |
symfony/symfony Packagist | From 6.0.0 | 6.4.11 |
symfony/symfony Packagist | From 6.0.0 | 6.4.11 |
symfony/symfony Packagist | From 7.0.0 | 7.1.4 |
symfony/symfony Packagist | From 7.0.0 | 7.1.4 |
6 more packages
symfony/validator Packagist | All versions | 5.4.43 |
symfony/validator Packagist | All versions | 5.4.43 |
symfony/validator Packagist | From 6.0.0 | 6.4.11 |
symfony/validator Packagist | From 6.0.0 | 6.4.11 |
symfony/validator Packagist | From 7.0.0 | 7.1.4 |
symfony/validator Packagist | From 7.0.0 | 7.1.4 |
How do I fix CVE-2024-50343?
Upgrade symfony/symfony to a fixed version for your release line: 5.4.43, 6.4.11 or 7.1.4.
Is CVE-2024-50343 being exploited?
There is no known exploitation of CVE-2024-50343 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-50343, GHSA-g3rh-rrhp-jhh9, UBUNTU-CVE-2024-50343.