Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-50342

CVE-2024-50342: Symfony allows internal address and port enumeration by NoPrivateNetworkHttpClient

3.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-50342
GHSA ID
GHSA-9c3x-r3wp-mgxm
EPSS Score
0.02523%
CWE
CWE-200
Published
11/6/2024
Updated
11/13/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
symfony/http-clientcomposer>= 4.3.0, < 5.4.475.4.47
symfony/http-clientcomposer>= 6.0.0, < 6.4.156.4.15
symfony/http-clientcomposer>= 7.0.0, < 7.1.87.1.8
symfony/symfonycomposer>= 4.3.0, < 5.4.475.4.47
symfony/symfonycomposer>= 6.0.0, < 6.4.156.4.15
symfony/symfonycomposer>= 7.0.0, < 7.1.87.1.8

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The analysis of the patch for CVE-2024-50342 reveals that the 'request' method in 'NoPrivateNetworkHttpClient' is the key function that was modified to fix the vulnerability. The change involves filtering blocked IPs earlier in the 'on_progress' callback, which is part of the 'request' method. This indicates that the 'request' method is the primary vulnerable function.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### **s*ription W**n usin* t** `NoPriv*t*N*twork*ttp*li*nt`, som* int*rn*l in*orm*tion is still l**kin* *urin* *ost r*solution, w*i** l***s to possi*l* IP/port *num*r*tion. ### R*solution T** `NoPriv*t*N*twork*ttp*li*nt` now *ilt*rs *lo*k** IPs **

Reasoning

T** *n*lysis o* t** p*t** *or *V*-****-***** r*v**ls t**t t** 'r*qu*st' m*t*o* in 'NoPriv*t*N*twork*ttp*li*nt' is t** k*y *un*tion t**t w*s mo*i*i** to *ix t** vuln*r**ility. T** ***n** involv*s *ilt*rin* *lo*k** IPs **rli*r in t** 'on_pro*r*ss' **ll