CVE-2012-6431: Symfony Allows URI Restrictions Bypass Via Double-Encoded String
6.4
CVSS Score
Basic Information
CVE ID
GHSA ID
EPSS Score
0.51555%
CWE
Published
5/17/2022
Updated
2/6/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
AV:N/AC:L/Au:N/C:P/I:P/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| symfony/http-foundation | composer | >= 2.0.0, < 2.0.19 | 2.0.19 |
| symfony/routing | composer | >= 2.0.0, < 2.0.19 | 2.0.19 |
| symfony/security | composer | >= 2.0.0, < 2.0.19 | 2.0.19 |
| symfony/symfony | composer | >= 2.0.0, < 2.0.19 | 2.0.19 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from inconsistent path handling between components. The Routing component (UrlMatcher) decoded paths twice (once via Request::getPathInfo() and again via urldecode()), while the Security component (RequestMatcher) used the single-decoded path from getPathInfo(). This allowed attackers to craft double-encoded URLs that matched routing patterns after decoding, but didn't match security rules. The key vulnerable functions are UrlMatcher::match() (for double-decoding) and RequestMatcher::matches() (for not accounting for double-decoding). Commit diffs show these components were modified in the patch (changing urldecode() to rawurldecode() in Routing, and adding rawurldecode() in Security checks).