CVE-2024-50345

Executive Summary

CVE-2024-50345 is a low-severity (CVSS 3.1) open redirect vulnerability in the Symfony http-foundation component, specifically within the Request class. The flaw arises because the Request class does not parse URIs containing special characters the same way modern browsers do. An attacker can craft a malicious URI that, when processed by a Symfony-based application, tricks a validator into redirecting users to an attacker-controlled domain. This can be leveraged for phishing, credential harvesting, or bypassing URL-based access controls.

The vulnerability affects all Symfony versions prior to 5.4.46, 6.4.14, and 7.1.7. The patch introduces strict URI validation in the Request::create method, rejecting any URI containing characters not allowed by the WHATWG URL specification. No public proof-of-concept or exploit code is available at this time, and the EPSS score is 0.0%, indicating low exploitation activity.

Supply Chain & Package Security

Symfony is a widely used PHP framework, and the symfony/http-foundation package is a core dependency for many web applications. This vulnerability is distributed via Composer (Packagist). Organizations using Symfony should immediately audit their composer.lock files for affected versions. The supply chain risk is moderate due to the low severity and lack of active exploitation, but the potential for phishing attacks makes timely patching critical.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (redirect to malicious domain)
• Availability Impact: None

Threat Level: Low. The vulnerability requires user interaction and only allows redirection, not direct code execution or data theft. However, it can be chained with other attacks (e.g., phishing) to increase impact.

Deep Dive & Mechanics

The core issue lies in the Request::create method of symfony/http-foundation. This method is used to create a Request object from a URI string. The vulnerability occurs because the method does not validate the URI against the WHATWG URL specification, which defines how browsers should parse URLs.

How it works:

1. An attacker crafts a URI containing special characters (e.g., \, @, or encoded characters) that browsers interpret differently than Symfony's Request class.
2. For example, a URI like http://trusted.com\@evil.com might be parsed by a browser as a request to evil.com (due to the @ sign), but Symfony's Request class might treat it as a valid path on trusted.com.
3. If an application uses the Request object to validate redirect destinations (e.g., after login), the attacker can bypass the validation and redirect the user to evil.com.

Technical Detail:

The WHATWG URL spec defines a strict set of allowed characters in URLs. Characters like backslash (\), certain control characters, and non-ASCII characters without proper encoding can cause parsing discrepancies. The patch adds a check in Request::create that throws an exception if the URI contains any invalid characters, forcing developers to use properly encoded URIs.

Vulnerable vs. Patched Code

Vulnerable Code (Symfony < 5.4.46, < 6.4.14, < 7.1.7):

// In Request.php
public static function create(string $uri, array $server = [], array $headers = []): static
{
    // No validation of URI characters
    $parts = parse_url($uri);
    // ... rest of the method
}

Patched Code (Symfony >= 5.4.46, >= 6.4.14, >= 7.1.7):

// In Request.php
public static function create(string $uri, array $server = [], array $headers = []): static
{
    // Validate URI against WHATWG spec
    if (preg_match('/[^\x20-\x7E\x80-\xFF]/', $uri) || str_contains($uri, '\\')) {
        throw new InvalidArgumentException(sprintf('Invalid URI "%s".', $uri));
    }
    $parts = parse_url($uri);
    // ... rest of the method
}

The patch adds a regex check that rejects any URI containing characters outside the printable ASCII range (0x20-0x7E) or extended ASCII (0x80-0xFF), and specifically blocks backslashes (\). This aligns Symfony's parsing with browser behavior.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Symfony application using an affected version of symfony/http-foundation.
• A publicly accessible endpoint that uses Request::create to validate redirect URLs (e.g., a login redirect).

Exploitation Steps:

1. Identify a redirect endpoint in the target application, such as /redirect?url=.
2. Craft a malicious URI that exploits the parsing discrepancy. For example:

   http://trusted.com/redirect?url=http://trusted.com\@evil.com
   

3. Send the crafted link to a victim (e.g., via email or social engineering).
4. When the victim clicks the link, the browser interprets http://trusted.com\@evil.com as a request to evil.com (due to the @ sign), while Symfony's Request class sees it as a valid path on trusted.com.
5. The victim is redirected to evil.com, where the attacker can host a phishing page.

Lab Setup:

# Create a vulnerable Symfony project
composer create-project symfony/skeleton:5.4.* test-app
cd test-app
composer require symfony/http-foundation:5.4.45

# Create a vulnerable redirect endpoint
cat > src/Controller/RedirectController.php << 'EOF'
<?php

namespace App\Controller;

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\Routing\Annotation\Route;

class RedirectController
{
    #[Route('/redirect', name: 'redirect')]
    public function redirectAction(Request $request): RedirectResponse
    {
        $url = $request->query->get('url', '/');
        // Vulnerable: no validation of URL
        return new RedirectResponse($url);
    }
}
EOF

# Run the app
symfony server:start

Exploit Payload:

http://localhost:8000/redirect?url=http://trusted.com\@evil.com

Blue Team

Detection Steps:

1. Monitor Logs: Look for URIs containing backslashes (\) or unusual characters in redirect parameters.
2. Web Application Firewall (WAF): Deploy rules to block requests with \ in query parameters, especially in redirect URLs.
3. Input Validation: Ensure all redirect URLs are validated against a whitelist of allowed domains.
4. User Education: Train users to be cautious of URLs containing backslashes or @ signs.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri=*\\* OR uri=*@*
| table _time, clientip, uri, referer

Indicators of Compromise (IOCs)

• Network Indicators:
  • URIs containing backslash (\) followed by a domain (e.g., http://trusted.com\@evil.com).
  • Redirect responses (HTTP 302) to unexpected domains.
• File Indicators:
  • composer.lock entries showing symfony/http-foundation version < 5.4.46, < 6.4.14, or < 7.1.7.
• Log Indicators:
  • PHP warnings or exceptions related to InvalidArgumentException with "Invalid URI" message (post-patch).
  • Access logs showing \ in the request URI.

Detection Engineering

YARA Rule

rule CVE_2024_50345_Symfony_Open_Redirect {
    meta:
        description = "Detects vulnerable Symfony http-foundation versions in composer.lock"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-50345"
        severity = "low"
    strings:
        $a = /"symfony\/http-foundation":\s*"[0-9]+\.[0-9]+\.[0-9]+"/
        $b = /"version":\s*"[0-9]+\.[0-9]+\.[0-9]+"/
    condition:
        $a and $b and (
            for any i in (1..#a) : (
                uint16(0) == 0x0a0a and
                ( // Check for vulnerable versions
                    ($a[i] contains "5.4." and not $a[i] contains "5.4.46") or
                    ($a[i] contains "6.4." and not $a[i] contains "6.4.14") or
                    ($a[i] contains "7.1." and not $a[i] contains "7.1.7")
                )
            )
        )
}

Sigma Rule

title: CVE-2024-50345 - Symfony Open Redirect via URI Parsing Discrepancy
id: 8f7b3c2a-1d5e-4f6a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects HTTP requests with backslashes in URI, indicating potential exploitation of CVE-2024-50345
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-50345
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: '\\'
    condition: selection
falsepositives:
    - Legitimate use of backslashes in rare cases (e.g., file paths)
level: low

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50345 - Symfony Open Redirect via URI Parsing Discrepancy"; flow:to_server,established; content:"\\"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Symfony: Update symfony/http-foundation to the patched versions:

   • 5.4.46 or later for Symfony 5.4.x
   • 6.4.14 or later for Symfony 6.4.x
   • 7.1.7 or later for Symfony 7.1.x

   composer require symfony/http-foundation:^5.4.46
   # or
   composer require symfony/http-foundation:^6.4.14
   # or
   composer require symfony/http-foundation:^7.1.7
   

2. Validate Redirect URLs: Implement server-side validation of all redirect destinations against a whitelist of allowed domains.

3. WAF Rules: Deploy WAF rules to block URIs containing backslashes or other suspicious characters.

Long-term Mitigations:

• Input Sanitization: Use Symfony's built-in UrlValidator or similar libraries to validate URLs.
• Security Headers: Implement Content-Security-Policy headers to restrict navigation.
• Regular Audits: Periodically review composer.lock for outdated dependencies.

Workarounds: None officially provided by Symfony. The only effective mitigation is upgrading.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert