CVE-2024-50342

Executive Summary

CVE-2024-50342 is a low-severity information disclosure vulnerability in the Symfony PHP framework's symfony/http-client module, specifically within the NoPrivateNetworkHttpClient component. This component is designed to prevent HTTP requests to private or internal network addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and localhost). The vulnerability allows an attacker to perform IP/port enumeration by observing timing differences or error messages during host resolution, even when the client is configured to block private network requests. The root cause is that the filtering occurs too late in the request lifecycle, after DNS resolution has already leaked information about internal hosts.

The vulnerability has a CVSS score of 3.1 (Low), an EPSS score of 0.0%, and no known public exploits or proof-of-concept code. The patch, available in versions 5.4.46, 6.4.14, and 7.1.7, moves the IP filtering earlier in the process to prevent this information leak.

Supply Chain & Package Security

This vulnerability affects the symfony/http-client package, which is a core component of the Symfony PHP framework. It is distributed via Composer (Packagist). The package is widely used in PHP applications for making HTTP requests. The vulnerability does not introduce a direct remote code execution or data breach risk, but it can aid attackers in reconnaissance by revealing internal network topology. Organizations using Symfony should ensure they are on a patched version to prevent internal network enumeration.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): High (H) – Exploitation requires specific conditions, such as the attacker being able to trigger DNS resolution for internal hosts.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): Low (L) – Limited information disclosure (IP/port enumeration).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Low. The vulnerability is difficult to exploit and only leaks internal network information, not sensitive data. However, it can be a stepping stone for more targeted attacks.

Deep Dive & Mechanics

The NoPrivateNetworkHttpClient is a decorator for Symfony's HTTP client that is intended to block requests to private IP ranges. It works by intercepting the request and checking the resolved IP address against a list of private network ranges. If the IP is private, the request is blocked.

Vulnerability Mechanism:

1. DNS Resolution: When a request is made to a hostname (e.g., http://internal-server.local), the HTTP client first resolves the hostname to an IP address via DNS.
2. Late Filtering: The NoPrivateNetworkHttpClient performs its IP check after DNS resolution. This means that even if the request is ultimately blocked, the DNS resolution has already occurred.
3. Information Leak: An attacker can observe the time taken for the request to fail or the specific error message returned. By sending requests to various hostnames, they can infer which internal hosts exist (based on DNS resolution success) and which ports are open (based on connection timeout vs. immediate block).

Example Scenario:

• Attacker sends a request to http://192.168.1.1:80.
• The client resolves the IP (no DNS needed for raw IP) and then checks if it's private.
• The request is blocked, but the attacker can measure the response time. If the IP is reachable, the block might take longer than if the IP is unreachable.
• By iterating through IPs and ports, the attacker can map internal network services.

Patch Details: The fix moves the IP filtering to occur before DNS resolution. The NoPrivateNetworkHttpClient now checks if the hostname resolves to a private IP before attempting the connection. This prevents any timing or error-based leakage.

Vulnerable vs. Patched Code

Vulnerable Code (Symfony 7.1.6):

// In NoPrivateNetworkHttpClient.php
public function request(string $method, string $url, array $options = []): ResponseInterface
{
    // ... 
    $response = $this->client->request($method, $url, $options);
    // After request, check if IP is private
    if ($this->isPrivateIp($response->getInfo('primary_ip'))) {
        throw new TransportException('...');
    }
    return $response;
}

Patched Code (Symfony 7.1.7):

// In NoPrivateNetworkHttpClient.php
public function request(string $method, string $url, array $options = []): ResponseInterface
{
    // Check before request
    $host = parse_url($url, PHP_URL_HOST);
    $ip = gethostbyname($host); // Resolve early
    if ($this->isPrivateIp($ip)) {
        throw new TransportException('...');
    }
    // Proceed with request
    return $this->client->request($method, $url, $options);
}

The key difference is the early resolution and check, preventing any network interaction with private hosts.

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Enumerate internal IPs and open ports using the vulnerable NoPrivateNetworkHttpClient.

Lab Setup:

1. Target: A Symfony application using symfony/http-client version < 5.4.46, < 6.4.14, or < 7.1.7 with NoPrivateNetworkHttpClient enabled.
2. Attacker Machine: Kali Linux with PHP and curl installed.

Exploitation Steps:

1. Identify the vulnerability: Confirm the Symfony version via HTTP headers or error messages.
2. Craft requests: Use a script to send requests to potential internal IPs and ports.
3. Measure response times: Use microtime() to detect timing differences.

Example Script (PHP):

<?php
require 'vendor/autoload.php';

use Symfony\Component\HttpClient\HttpClient;
use Symfony\Component\HttpClient\NoPrivateNetworkHttpClient;

$client = HttpClient::create();
$noPrivateClient = new NoPrivateNetworkHttpClient($client);

$targets = [
    'http://192.168.1.1:80',
    'http://192.168.1.1:22',
    'http://10.0.0.1:80',
    'http://172.16.0.1:443',
];

foreach ($targets as $url) {
    $start = microtime(true);
    try {
        $response = $noPrivateClient->request('GET', $url);
        $end = microtime(true);
        echo "Request to $url succeeded in " . ($end - $start) . " seconds\n";
    } catch (\Exception $e) {
        $end = microtime(true);
        echo "Request to $url failed in " . ($end - $start) . " seconds: " . $e->getMessage() . "\n";
    }
}

Expected Output:

• Requests to non-existent hosts will fail quickly (DNS failure).
• Requests to existing internal hosts will take longer (DNS resolution + connection attempt before block).

Blue Team (Defender)

Detection:

1. Monitor DNS queries: Look for unusual DNS resolution attempts to internal hostnames from the web server.
2. Log analysis: Check web server logs for requests to private IP ranges (e.g., 10.x.x.x, 172.16-31.x.x, 192.168.x.x).
3. Network monitoring: Detect outbound connection attempts to private IPs from the application server.

Mitigation:

• Apply the patch immediately.
• Use network segmentation to prevent the web server from reaching internal networks.
• Implement strict egress filtering.

Indicators of Compromise (IOCs)

• Network Traffic:
  • Outbound DNS queries for internal hostnames (e.g., internal-server.local, db.internal).
  • Outbound connection attempts to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• Logs:
  • Symfony error logs containing TransportException with messages like "Request to private network is not allowed."
  • Web server access logs with requests to private IPs in the URL.
• Application Behavior:
  • Unusual timing patterns in HTTP client responses.
  • Repeated requests to sequential IPs or ports.

Detection Engineering

YARA Rule

rule CVE_2024_50342_Symfony_NoPrivateNetwork {
    meta:
        description = "Detects vulnerable Symfony NoPrivateNetworkHttpClient code"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-50342"
    strings:
        $vuln_func = "NoPrivateNetworkHttpClient"
        $late_check = "isPrivateIp" nocase
        $early_check = "gethostbyname" nocase
    condition:
        $vuln_func and $late_check and not $early_check
}

Sigma Rule

title: CVE-2024-50342 - Symfony NoPrivateNetworkHttpClient Information Disclosure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-50342 by observing DNS queries to internal hosts
author: Valters IT
date: 2024/01/01
logsource:
    category: dns
    product: windows
detection:
    selection:
        QueryName|contains:
            - 'internal'
            - 'private'
            - 'localhost'
            - '10.'
            - '172.'
            - '192.168.'
    condition: selection
falsepositives:
    - Legitimate internal DNS queries
level: low

Suricata Rule

alert dns $HOME_NET any -> any 53 (msg:"CVE-2024-50342 - Symfony NoPrivateNetworkHttpClient DNS Enumeration"; dns.query; content:"internal"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Symfony: Update symfony/http-client to version 5.4.46, 6.4.14, or 7.1.7 or later.

   composer require symfony/http-client:^7.1.7
   

2. Verify patch: Check that NoPrivateNetworkHttpClient now uses early IP filtering.

Long-term Mitigations:

• Network Segmentation: Ensure the application server cannot reach internal networks directly.
• Egress Filtering: Block outbound traffic to private IP ranges at the firewall.
• Monitoring: Implement DNS and network traffic monitoring to detect reconnaissance attempts.
• Least Privilege: Run the application with minimal network permissions.

Workarounds (if patching is not possible):

• Disable NoPrivateNetworkHttpClient and implement custom IP filtering at the application level.
• Use a proxy that blocks private IPs before the request reaches the HTTP client.

Valters IT
Securing Digital Frontiers