CVE-2024-50343

Executive Summary

CVE-2024-50343 is a low-severity (CVSS 3.1) input validation bypass vulnerability in the Symfony PHP framework's symfony/validator component. The flaw allows an attacker to bypass regular expression validation when the regex pattern uses the $ metacharacter (end-of-string anchor). By appending a newline character (\n) to the input, the $ anchor in PCRE matches before the newline, allowing the attacker to inject content that should have been rejected. The Symfony team has patched this by adding the D (PCRE_DOLLAR_ENDONLY) modifier to all relevant regex patterns, forcing $ to match only at the very end of the input string.

Supply Chain & Package Security

This vulnerability affects the symfony/validator PHP package, distributed via Composer/Packagist. Organizations using Symfony in their supply chain should audit their composer.lock for affected versions. The package is a core component of the Symfony framework, widely used in enterprise PHP applications. An attacker exploiting this could bypass validation rules in forms, API inputs, or data processing pipelines, potentially leading to injection of malformed data into backend systems.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: High (requires specific regex pattern with $ and attacker-controlled newline)
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (validation bypass)
• Availability Impact: None

Threat Level: Low. The vulnerability requires specific conditions (regex with $ anchor, no D modifier) and has limited impact (validation bypass only). No public exploits or active weaponization have been observed.

Deep Dive & Mechanics

The vulnerability lies in how PHP's PCRE (Perl Compatible Regular Expressions) library handles the $ anchor by default. In PCRE, $ matches the end of the string OR just before a trailing newline at the end of the string. This behavior is controlled by the PCRE_DOLLAR_ENDONLY modifier (D). Without the D modifier, a regex like /^[a-z]+$/ will match "abc\n" because $ matches before the newline.

In symfony/validator, when a developer defines a validation constraint using a regular expression with $, the validator does not automatically apply the D modifier. An attacker can submit input ending with a newline character (\n), which passes the regex validation but contains additional content after the newline that should have been rejected.

Example:

• Regex: /^[a-zA-Z0-9]+$/
• Intended: Only alphanumeric strings
• Attacker input: "valid\n<script>alert('xss')</script>"
• Without D modifier: $ matches before \n, so "valid" passes, and the rest is ignored by the regex but may be processed by the application.

Vulnerable vs. Patched Code

Vulnerable Code (Symfony < 5.4.43, < 6.4.11, < 7.1.4):

// In RegexValidator.php or similar
if (!preg_match($pattern, $value)) {
    // validation fails
}

Patched Code (Symfony >= 5.4.43, >= 6.4.11, >= 7.1.4):

// The pattern is modified to include the 'D' modifier
if (!preg_match($pattern . 'D', $value)) {
    // validation fails
}

The patch ensures that all regex patterns using $ are compiled with the D modifier, forcing $ to match only at the absolute end of the input string, not before a trailing newline.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Symfony application using symfony/validator with a regex constraint that uses $ (e.g., @Regex(pattern="/^[a-z]+$/"))
• The application does not sanitize or strip trailing newlines before validation

Exploitation Steps:

1. Identify a form or API endpoint that uses a regex validation with $ anchor.
2. Craft a payload that ends with a newline character followed by malicious content.
3. Submit the payload. The regex will match the valid part before the newline, bypassing validation.
4. The application may then process the full input, including the malicious content.

Example Payload:

valid\n<script>alert('xss')</script>

Note: No public exploit code is available. This is a logical bypass, not a code execution vulnerability.

Blue Team

Detection:

• Monitor logs for input strings containing newline characters (\n, %0a, \x0a) in fields validated by regex.
• Look for validation bypass patterns where a valid prefix is followed by newline and unexpected content.

Hunting:

• Search application logs for regex validation failures that were followed by successful processing of the same input.
• Audit all custom regex patterns in Symfony validation constraints for use of $ without the D modifier.

Mitigation:

• Immediately upgrade to patched versions.
• As a temporary workaround, strip newline characters from input before validation: $input = str_replace("\n", '', $input);

Indicators of Compromise (IOCs)

• Network: HTTP requests containing %0a (URL-encoded newline) in form fields or JSON payloads
• Logs: Regex validation passing for inputs containing newline characters
• Application: Unexpected data processing after validation, such as stored XSS or injection of malformed data

Detection Engineering

YARA Rule

rule CVE_2024_50343_RegexBypass {
    meta:
        description = "Detects attempts to exploit CVE-2024-50343 Symfony validator regex bypass"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-50343"
    strings:
        $newline = /\n/
        $regex_pattern = /\/\^.*\$\//
    condition:
        $newline and $regex_pattern
}

Sigma Rule

title: CVE-2024-50343 Symfony Validator Regex Bypass Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with newline characters in fields validated by regex
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: '%0a'
    condition: selection
falsepositives:
    - Legitimate use of newlines in multi-line fields
level: low

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50343 Symfony Validator Regex Bypass Attempt"; flow:to_server; content:"%0a"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade symfony/validator to version 5.4.43, 6.4.11, or 7.1.4 (depending on your Symfony version).
2. Run composer update symfony/validator to apply the patch.

Compensating Controls:

• Add input sanitization to strip newline characters before validation: $input = str_replace(["\r", "\n"], '', $input);
• Review all custom regex patterns in validation constraints and add the D modifier manually: pattern="/^[a-z]+$/D"
• Implement Web Application Firewall (WAF) rules to block requests containing %0a in validated fields.

Long-term:

• Adopt a policy of using the D modifier in all regex patterns that use $ anchors.
• Regularly audit Symfony dependencies for security updates.

Valters IT - This report is provided as-is for educational and defensive purposes. Always verify with official sources before taking action.