Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-41267

CVE-2021-41267:
Webcache Poisoning in symfony/http-kernel

6.5

CVSS Score

Basic Information

CVE ID
CVE-2021-41267
GHSA ID
GHSA-q3j3-w37x-hq2q
EPSS Score
-
CWE
CWE-444
Published
11/24/2021
Updated
2/5/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
symfony/http-kernelcomposer>= 5.2.0, < 5.3.125.3.12
symfony/symfonycomposer>= 5.2.0, < 5.3.125.3.12

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from incomplete header trust validation in sub-request handling. The patch adds X-Forwarded-Prefix to the array of headers checked against trusted_headers (commit 95dcf51). Before this fix, SubRequestHandler::handle() only validated X-Forwarded-Host/Proto/Port but not X-Forwarded-Prefix, allowing untrusted values to propagate in sub-requests. The test cases in SubRequestHandlerTest.php demonstrate that untrusted X-Forwarded-Prefix headers were previously retained in sub-requests.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**s*ription ----------- W**n * Sym*ony *ppli**tion is runnin* ***in* * proxy or * lo**-**l*n**r, you **n t*ll Sym*ony to look *or t** `X-*orw*r***-*` *TTP *****rs. *TTP *****rs t**t *r* not p*rt o* t** "trust**_*****rs" *llow** list *r* i*nor** *n*

Reasoning

T** vuln*r**ility st*ms *rom in*ompl*t* *****r trust v*li**tion in su*-r*qu*st **n*lin*. T** p*t** ***s X-*orw*r***-Pr**ix to t** *rr*y o* *****rs ****k** ***inst trust**_*****rs (*ommit *******). ***or* t*is *ix, Su*R*qu*st**n*l*r::**n*l*() only v*l