Miggo Logo
Miggo Vulnerability Database
→
CVE-2015-2309

CVE-2015-2309: Symfony has unsafe methods in the Request class

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2015-2309
GHSA ID
GHSA-p684-f7fh-jv2j
EPSS Score
-
CWE
CWE-20
Published
5/30/2024
Updated
5/30/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
symfony/http-foundationcomposer>= 2.0.0, < 2.3.272.3.27
symfony/http-foundationcomposer>= 2.4.0, < 2.5.112.5.11
symfony/http-foundationcomposer>= 2.6.0, < 2.6.62.6.6
symfony/symfonycomposer>= 2.0.0, < 2.3.272.3.27
symfony/symfonycomposer>= 2.4.0, < 2.5.112.5.11
symfony/symfonycomposer>= 2.6.0, < 2.6.62.6.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from these methods trusting HTTP headers (X-Forwarded-* etc.) based solely on the presence of any configured trusted proxies, without verifying the actual remote address making the request. The commit diff shows they previously checked self::$trustedProxies existence but not whether the current REMOTE_ADDR was in that list. This allowed MITM attacks between the last trusted proxy and server. The patch introduced isFromTrustedProxy() to validate REMOTE_ADDR against trusted proxies before trusting headers.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*ll *.*.X, *.*.X, *.*.X, *.*.X, *.*.X, *.*.X, *n* *.*.X v*rsions o* t** Sym*ony *ttp*oun**tion *ompon*nt *r* *****t** *y t*is s**urity issu*. T*is issu* **s ***n *ix** in Sym*ony *.*.**, *.*.**, *n* *.*.*. Not* t**t no *ix*s *r* provi*** *or Sym*ony

Reasoning

T** vuln*r**ility st*ms *rom t**s* m*t*o*s trustin* *TTP *****rs (X-*orw*r***-* *t*.) **s** sol*ly on t** pr*s*n** o* *ny *on*i*ur** trust** proxi*s, wit*out v*ri*yin* t** **tu*l r*mot* ***r*ss m*kin* t** r*qu*st. T** *ommit *i** s*ows t**y pr*viousl