PHP: уязвимости стека · Страница 35

Twig: Sandbox property and method bypass via object-destructuring assignment

Twig is a template language for PHP. From 3.24.0 until 3.26.0, object-destructuring assignment compiles CoreExtension::getAttribute() with the sandbox argument hardcoded to false, disabling property and method policy checks and allowing an attacker with write access to a sandboxed Twig template to read public properties or invoke public getters on objects passed to the template engine. This issue is fixed in version 3.26.0.

• Обновитесь до 3.26.0
• Обновитесь до 3.26.0-1

Twig: Sandbox property allowlist bypass via the `column` filter (array_column on objects)

Twig is a template language for PHP. Prior to 3.26.0, the column filter passes object arrays to PHP array_column(), which reads public and magic properties without reaching CoreExtension::getAttribute() or SandboxExtension::checkPropertyAllowed(), allowing an untrusted template author with column in allowedFilters to read properties that are not in the sandbox allowlist. This issue is fixed in version 3.26.0.

• Обновитесь до 3.26.0
• Обновитесь до 3.26.0-1
• Обновитесь до 3.27.0-0+deb13u1

Twig Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points

Twig is a template language for PHP. Prior to 3.26.0, several Twig language constructs trigger PHP string coercion on a Stringable operand without consulting SecurityPolicy::checkMethodAllowed(), allowing a sandboxed template author to invoke __toString() on objects reachable in the render context through conditional expressions, comparison operators, tests, template-loading tags, dynamic attribute names, spread arguments, the do tag, and the .. range operator. This issue is fixed in version 3.26.0.

• Обновитесь до 3.26.0
• Обновитесь до 3.26.0-1
• Обновитесь до 3.27.0-0+deb13u1

FacturaScripts: Path traversal in UploadedFile::move() via getClientOriginalName() — arbitrary file write outside MyFiles/ leading to RCE

## Summary `FacturaScripts\Core\UploadedFile::move($destiny, $destinyName)` concatenates `$destiny` and `$destinyName` without normalizing the resulting path. Every caller in the codebase passes `UploadedFile::getClientOriginalName()` — the unsanitized client-supplied filename — as `$destinyName`, so an authenticated user submitting a filename containing `../` segments can write the uploaded content to any directory writable by the web-server user, escaping the intended `MyFiles/` location. Because the shipped `htaccess-sample` (the documented production Apache configuration) excludes `Dinamic/Assets/` and `node_modules/` from the `index.ph

symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence

Symfony Polyfill backports PHP features and provides compatibility layers for extensions and functions. From 1.17.1 until 1.38.1, symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload is empty or decodes to ASCII-only code points because Idn::process() does not enforce the UTS #46 revision 33 requirement that decoded ACE labels contain at least one non-ASCII code point. Originally unequal domain names can be regarded as equal, which can lead to blacklist bypassing, inconsistent URL parsing, and server-side request forgery in applications using the polyfill to canonicalise or compare hostnames. This issue is fixed in version 1.3

• Обновитесь до 1.38.1
• Обновитесь до 1.38.1-1

Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on <object>, <applet>, <iframe>, <img> and the URL Inside <meta http-equiv="refresh"> content

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs inside content bypassed URL sanitization, allowing explicitly enabled elements or attributes to pass javascript: and similar payloads into sanitized output. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.

• Обновитесь до 6.4.41
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.13
• Обновитесь до 7.4.13+dfsg-1
• Обновитесь до 8.0.13

Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.13 and 8.0.13, MailomatRequestParser::validateSignature() parsed X-MOM-Webhook-Signature as algo=signature and passed the request-selected algorithm to hash_hmac(), allowing a signature algorithm downgrade instead of enforcing Mailomat's documented SHA-256 webhook signature. This issue is fixed in versions 7.4.13 and 8.0.13.

• Обновитесь до 7.4.13
• Обновитесь до 7.4.13+dfsg-1
• Обновитесь до 8.0.13

Symfony: Security Firewall Bypass via failure_forward Subrequest: Unauthenticated Access to access_control-Protected GET Routes

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, DefaultAuthenticationFailureHandler honored the request-supplied _failure_path parameter when failure_forward: true was enabled, allowing an unauthenticated failing login request to dispatch a subrequest to access_control-protected GET routes that skipped firewall listeners. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

• Обновитесь до 5.4.53
• Обновитесь до 5.4.53+dfsg-0+deb12u1
• Обновитесь до 6.4.41
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.13
• Обновитесь до 7.4.13+dfsg-1
• Обновитесь до 8.0.13

Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0 until 6.4.41, 7.4.13, and 8.0.13, UrlSanitizer::parse() rejected raw BiDi formatting characters but not percent-encoded forms and used an ASCII-only whitespace check, allowing sanitized URLs to retain visual-spoofing characters that downstream consumers could decode or display. This issue is fixed in versions 6.4.41, 7.4.13, and 8.0.13.

• Обновитесь до 6.4.41
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.13
• Обновитесь до 7.4.13+dfsg-1
• Обновитесь до 8.0.13

Symfony: IpUtils::PRIVATE_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.0 to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, NoPrivateNetworkHttpClient and IpUtils::PRIVATE_SUBNETS omitted IPv6 transition prefixes such as 6to4, NAT64, Teredo, and IPv4-compatible IPv6, allowing attacker-supplied URLs to represent private IPv4 targets in forms that IpUtils::isPrivateIp() did not block. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

• Обновитесь до 5.4.53
• Обновитесь до 5.4.53+dfsg-0+deb12u1
• Обновитесь до 6.4.41
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.13
• Обновитесь до 7.4.13+dfsg-1
• Обновитесь до 8.0.13

Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate() used strtr() dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters to generate URLs that collapse to a different path under RFC 3986 normalization. This issue is fixed in versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13.

• Обновитесь до 5.4.53
• Обновитесь до 5.4.53+dfsg-0+deb12u1
• Обновитесь до 6.4.41
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.13
• Обновитесь до 7.4.13+dfsg-1
• Обновитесь до 8.0.13

Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, SendmailTransport in -t mode appended recipient addresses to the sendmail command line without a -- end-of-options separator, allowing an address beginning with - to be interpreted as a sendmail command-line option instead of an address. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

• Обновитесь до 5.4.52
• Обновитесь до 5.4.53+dfsg-0+deb12u1
• Обновитесь до 6.4.40
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.12
• Обновитесь до 7.4.12+dfsg-1
• Обновитесь до 8.0.12

Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, TwilioRequestParser::doParse() received the configured webhook secret but ignored the X-Twilio-Signature HMAC header, allowing unauthenticated POST requests to inject forged Twilio status payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

• Обновитесь до 6.4.40
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.12
• Обновитесь до 7.4.12+dfsg-1
• Обновитесь до 8.0.12

Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Crawler::addXmlContent() set DOMDocument::$validateOnParse = true before loadXML(), re-enabling external entity resolution and allowing attacker-supplied XML to expand file:// entities such as local files. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

• Обновитесь до 5.4.52
• Обновитесь до 5.4.53+dfsg-0+deb12u1
• Обновитесь до 6.4.40
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.12
• Обновитесь до 7.4.12+dfsg-1
• Обновитесь до 8.0.12

Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 7.4.12 and 8.0.12, MailtrapRequestParser::doParse() received the configured webhook secret but ignored the X-Mt-Signature HMAC header, allowing unauthenticated POST requests to inject forged Mailtrap delivery, bounce, open, click, or spam events. This issue is fixed in versions 7.4.12 and 8.0.12.

• Обновитесь до 7.4.12
• Обновитесь до 7.4.12+dfsg-1
• Обновитесь до 8.0.12

Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, the Mailjet mailer bridge and LOX24 notifier bridge webhook parsers received configured webhook secrets but did not verify them, allowing unauthenticated POST requests to inject forged Mailjet and LOX24 event payloads. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

• Обновитесь до 6.4.40
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.12
• Обновитесь до 7.4.12+dfsg-1
• Обновитесь до 8.0.12

Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser::cleanup() used regular expressions with overlapping quantifiers for YAML directive, comment, and document marker cleanup, allowing crafted input to make parsing hang for an arbitrarily long time. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

• Обновитесь до 5.4.52
• Обновитесь до 5.4.53+dfsg-0+deb12u1
• Обновитесь до 6.4.40
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.12
• Обновитесь до 7.4.12+dfsg-1
• Обновитесь до 8.0.12

Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, Symfony\Component\Yaml\Parser resolved YAML collection aliases recursively, allowing a small untrusted YAML input to expand into a multi-gigabyte structure and exhaust memory. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

• Обновитесь до 5.4.52
• Обновитесь до 5.4.53+dfsg-0+deb12u1
• Обновитесь до 6.4.40
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.12
• Обновитесь до 7.4.12+dfsg-1
• Обновитесь до 8.0.12

Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.

• Обновитесь до 6.4.40
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.12
• Обновитесь до 7.4.12+dfsg-1
• Обновитесь до 8.0.12

Symfony: [Yaml] Harden the parser when handling untrusted input

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, when the parser is exposed to attacker-controlled input, deeply nested mappings or sequences cause both the block-level (Parser::parseBlock()) and inline (Inline::parseSequence() / Inline::parseMapping()) parsers to recurse without a depth limit. A crafted document exhausts the PHP stack and crashes the worker. This issue is fixed in versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12.

• Обновитесь до 5.4.52
• Обновитесь до 5.4.53+dfsg-0+deb12u1
• Обновитесь до 6.4.40
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 7.4.12
• Обновитесь до 7.4.12+dfsg-1
• Обновитесь до 8.0.12