Symfony DataUriNormalizer reads arbitrary server files via uppercase DATA: URIs
A PHP web development tool can let outsiders peek at server files.
Summary
The DataUriNormalizer in the Symfony Serializer component opens a DATA: value with an uppercase scheme as a local file, so one request can read arbitrary server files. Versions before 5.4.56, 6.x before 6.4.50, 7.x before 7.4.23, and 8.x before 8.1.11 are affected.
Affected when
- Endpoints that deserialize untrusted input into File, SplFileInfo, or SplFileObject
- FrameworkBundle default settings
What to do
Update to Symfony 5.4.56, 6.4.50, 7.4.23, or 8.1.11 or later.
Update to at least the version for your product:
- Symfony 5.4 5.4.56 or later
- Symfony 6.4 6.4.50 or later
- Symfony 7.4 7.4.23 or later
- Symfony 8.1 8.1.11 or later
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen