Symfony Debug Mode Enabled

high Web App Scanning Plugin ID 113933

Language:

Synopsis

Description

Symfony is a free and open-source PHP web application framework relying on bundles, which are plugins allowing developers to hook into Symfony. Symfony offers a debug mode which allows developers to get additional tools like the web profiler and the debug toolbar to help troubleshooting their applications : stack traces on error pages, profiler and phpinfo exposing the PHP environment configuration. A remote and unauthenticated attacker could leverage these information to access sensitive information about current application requests and configuration.

Solution

Disable Symfony debug mode by setting `APP_DEBUG=0` and ensure that the exposed application is running in the `prod` environment. On older Symfony versions, ensure that access to `app_dev.php` is restricted to localhost (configuration by default). If any secret has been exposed with the debug mode, revoke and rotate it.