JVNDB-2015-000089

Symfony vulnerable to code injection

Symfony is an open source web application framework provided by SensioLabs. Symfony contains a code injection vulnerability. Applications with ESI support enabled and using the Symfony built-in reverse proxy (the HttpCache class) are affected.

Takeshi Terada of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Sensio Labs

• Symfony 2.0.x, 2.1.x, 2.2.x, 2.3.x, 2.4.x, 2.5.x, 2.6.x

Arbitrary PHP code may be executed on the server where an application using Symfony resides.

[Update the software]
Update to the appropriate version according to the information provided by the developer.
This vulnerability has been addressed in Symfony 2.3.27, 2.5.11 and 2.6.6.

Note that Symfony 2.0, 2.1, 2.2 and 2.4 are no longer being developed or supported therefore this issue has not been fixed in these versions.

Sensio Labs

• Sensio Labs : CVE-2015-2308: Esi Code Injection

1. Code Injection(CWE-94) [IPA Evaluation]

1. CVE-2015-2308

1. JVN : JVN#19578958
2. National Vulnerability Database (NVD) : CVE-2015-2308
3. IPA SECURITY ALERTS : Security Alert for Vulnerability in Symfony (JVN#19578958) (in Japanese)

• [2015/06/23]
    Web page was published
  [2015/06/25]
    References : Content was added