cvelistv5 - cve-2018-14773

cve-2018-14773

Vulnerability from cvelistv5

Published

2018-08-03 17:00

Modified

2024-08-05 09:38

Severity ?

Summary

An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.

References

URL	Tags
cve@mitre.org	http://www.securityfocus.com/bid/104943	Third Party Advisory, VDB Entry
cve@mitre.org	http://www.securitytracker.com/id/1041405	Third Party Advisory, VDB Entry
cve@mitre.org	https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b	Issue Tracking, Patch, Third Party Advisory
cve@mitre.org	https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html	Mailing List, Third Party Advisory
cve@mitre.org	https://seclists.org/bugtraq/2019/May/21	Issue Tracking, Mailing List, Third Party Advisory
cve@mitre.org	https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers	Patch, Vendor Advisory
cve@mitre.org	https://www.debian.org/security/2019/dsa-4441	Third Party Advisory
cve@mitre.org	https://www.drupal.org/SA-CORE-2018-005	Patch, Third Party Advisory

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T09:38:13.839Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "104943",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104943"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.drupal.org/SA-CORE-2018-005"
          },
          {
            "name": "[debian-lts-announce] 20190310 [SECURITY] [DLA 1707-1] symfony security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b"
          },
          {
            "name": "1041405",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041405"
          },
          {
            "name": "DSA-4441",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2019/dsa-4441"
          },
          {
            "name": "20190510 [SECURITY] [DSA 4441-1] symfony security update",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "https://seclists.org/bugtraq/2019/May/21"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-08-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it\u0027s not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \\Symfony\\Component\\HttpFoundation\\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-05-10T15:06:07",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "104943",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104943"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.drupal.org/SA-CORE-2018-005"
        },
        {
          "name": "[debian-lts-announce] 20190310 [SECURITY] [DLA 1707-1] symfony security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b"
        },
        {
          "name": "1041405",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041405"
        },
        {
          "name": "DSA-4441",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2019/dsa-4441"
        },
        {
          "name": "20190510 [SECURITY] [DSA 4441-1] symfony security update",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "https://seclists.org/bugtraq/2019/May/21"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-14773",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it\u0027s not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \\Symfony\\Component\\HttpFoundation\\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "104943",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104943"
            },
            {
              "name": "https://www.drupal.org/SA-CORE-2018-005",
              "refsource": "CONFIRM",
              "url": "https://www.drupal.org/SA-CORE-2018-005"
            },
            {
              "name": "[debian-lts-announce] 20190310 [SECURITY] [DLA 1707-1] symfony security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html"
            },
            {
              "name": "https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers",
              "refsource": "CONFIRM",
              "url": "https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers"
            },
            {
              "name": "https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b",
              "refsource": "CONFIRM",
              "url": "https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b"
            },
            {
              "name": "1041405",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041405"
            },
            {
              "name": "DSA-4441",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2019/dsa-4441"
            },
            {
              "name": "20190510 [SECURITY] [DSA 4441-1] symfony security update",
              "refsource": "BUGTRAQ",
              "url": "https://seclists.org/bugtraq/2019/May/21"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-14773",
    "datePublished": "2018-08-03T17:00:00",
    "dateReserved": "2018-07-31T00:00:00",
    "dateUpdated": "2024-08-05T09:38:13.839Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-14773\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2018-08-03T17:29:00.297\",\"lastModified\":\"2021-09-29T16:21:53.303\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it\u0027s not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \\\\Symfony\\\\Component\\\\HttpFoundation\\\\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.\"},{\"lang\":\"es\",\"value\":\"Se ha descubierto un problema en Http Foundation en Symfony, desde la versi\u00f3n 2.7.0 hasta la 2.7.48, desde la versi\u00f3n 2.8.0 hasta la 2.8.43, desde la versi\u00f3n 3.3.0 hasta la 3.3.17, desde la versi\u00f3n 3.4.0 hasta la 3.4.13, desde la versi\u00f3n 4.0.0 hasta la 4.0.13 y desde la versi\u00f3n 4.1.0 hasta la 4.1.2. Se origina desde el soporte a una cabecera IIS (heredada) que deja que los usuarios sobrescriban la ruta en la URL de petici\u00f3n mediante la cabecera de petici\u00f3n HTTP X-Original-URL o X-Rewrite-URL. Estas cabeceras han sido dise\u00f1adas para ser compatibles con IIS, pero no est\u00e1 verificado que el servidor est\u00e9, de hecho, ejecutando IIS, lo que significa que cualquiera que pueda enviar estas peticiones a la aplicaci\u00f3n puede desencadenar este problema. Esto afecta a \\\\Symfony\\\\Component\\\\HttpFoundation\\\\Request::prepareRequestUri() donde se emplean tanto X-Original-URL como X_REWRITE_URL. La soluci\u00f3n elimina el soporte a estos m\u00e9todos para que no puedan ser empleados como vectores de ataque, como el envenenamiento de la cach\u00e9 web.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.0},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*\",\"versionStartExcluding\":\"2.7.0\",\"versionEndIncluding\":\"2.7.48\",\"matchCriteriaId\":\"75150355-4AEB-4409-B8AE-413A1A7E6EA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.8.0\",\"versionEndIncluding\":\"2.8.43\",\"matchCriteriaId\":\"D9158CA7-0193-4342-9A09-126D8F667591\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.3.0\",\"versionEndIncluding\":\"3.3.17\",\"matchCriteriaId\":\"933F48FF-3D58-455A-85D5-563A5C454020\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.4.0\",\"versionEndIncluding\":\"3.4.13\",\"matchCriteriaId\":\"09200F9D-A68B-4322-9626-7A869EC1E18A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.0.0\",\"versionEndIncluding\":\"4.0.13\",\"matchCriteriaId\":\"77747DC8-9E86-4619-A98F-CAC8BF7BA7B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.1.0\",\"versionEndIncluding\":\"4.1.2\",\"matchCriteriaId\":\"0261DC21-9664-4D09-AE19-632C0D083D48\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndExcluding\":\"8.5.6\",\"matchCriteriaId\":\"60BDF39F-889D-47FE-9345-BBC78FBC1A44\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/104943\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.securitytracker.com/id/1041405\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2019/03/msg00009.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://seclists.org/bugtraq/2019/May/21\",\"source\":\"cve@mitre.org\",\"tags\":[\"Issue Tracking\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://www.debian.org/security/2019/dsa-4441\",\"source\":\"cve@mitre.org\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.drupal.org/SA-CORE-2018-005\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}"
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2018-14773

Vulnerability from cvelistv5

gsd-2018-14773

Vulnerability from gsd

ghsa-8wgj-6wx8-h5hq

Vulnerability from github

Tags

Sightings

Nomenclature