FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.

**2.5.12** (2015-05-27)

  - security #14759 CVE-2015-4050 [HttpKernel] Do not call     the FragmentListener if _controller is already defined     (jakzal)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jakub Zalas discovered that Symfony, a framework to create websites and web applications, was vulnerable to restriction bypass. It was affecting applications with ESI or SSI support enabled, that use the FragmentListener. A malicious user could call any controller via the /_fragment path by providing an invalid hash in the URL (or removing it), bypassing URL signing and security rules.

ID	Name	Product	Family	Severity
84041	Fedora 21 : php-symfony-2.5.12-1.fc21 (2015-9039)	Nessus	Fedora Local Security Checks	medium
84040	Fedora 22 : php-symfony-2.5.12-1.fc22 (2015-9034)	Nessus	Fedora Local Security Checks	medium
84039	Fedora 20 : php-symfony-2.5.12-1.fc20 (2015-9025)	Nessus	Fedora Local Security Checks	medium
83919	Debian DSA-3276-1 : symfony - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2015-4050

medium

Tenable Plugins

medium

medium

medium

medium