CVE-2025-47946

Executive Summary

CVE-2025-47946 is a Cross-Site Scripting (XSS) vulnerability in the Symfony UX ecosystem, specifically within the symfony/ux-twig-component package. The flaw arises from improper output escaping when rendering {{ attributes }} or any method that returns a ComponentAttributes instance (e.g., only(), defaults(), without()). If these attribute values contain untrusted user input, an attacker can inject arbitrary HTML attributes, leading to XSS attacks. The vulnerability is fixed in version 2.25.1 of both symfony/ux-twig-component and symfony/ux-live-component. The CVSS score is 6.1 (Medium), and no public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

This vulnerability affects the PHP ecosystem via the Symfony framework. The vulnerable packages are distributed through Composer (Packagist). Organizations using Symfony UX components must verify their composer.json for symfony/ux-twig-component and symfony/ux-live-component and ensure they are updated to version 2.25.1 or later. The supply chain risk is moderate, as the vulnerability requires user interaction (e.g., clicking a link) and is not directly exploitable without a crafted input.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the requirement for user interaction and the limited impact on confidentiality and integrity. However, in contexts where user input is rendered unsafely, the risk of XSS can be elevated.

Deep Dive & Mechanics

The vulnerability resides in the ComponentAttributes class within symfony/ux-twig-component. When Twig renders {{ attributes }} or calls methods like only(), defaults(), or without(), the output is not HTML-escaped. This means that if an attribute value contains malicious JavaScript or HTML, it will be injected directly into the DOM.

Root Cause: The __toString() method of ComponentAttributes returns the raw attribute string without applying htmlspecialchars() or similar escaping. This is a classic XSS vulnerability.

Attack Scenario: An attacker can inject a malicious attribute value via user input (e.g., a form field, URL parameter, or database content). When the component renders {{ attributes }}, the injected payload executes in the victim's browser.

Example Payload:

<input name="test" value="&quot; onclick=&quot;alert('XSS')&quot;">

If this value is passed to a component attribute and rendered unsafely, it becomes:

<div onclick="alert('XSS')">...</div>

Vulnerable vs. Patched Code

Vulnerable Code (before 2.25.1):

// ComponentAttributes.php
public function __toString(): string
{
    $html = '';
    foreach ($this->attributes as $name => $value) {
        $html .= ' '.$name.'="'.$value.'"';
    }
    return $html;
}

Patched Code (2.25.1):

// ComponentAttributes.php
public function __toString(): string
{
    $html = '';
    foreach ($this->attributes as $name => $value) {
        $html .= ' '.$name.'="'.htmlspecialchars($value, ENT_QUOTES, 'UTF-8').'"';
    }
    return $html;
}

The patch adds htmlspecialchars() to escape attribute values, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Symfony application using symfony/ux-twig-component < 2.25.1.
• A component that renders user-controlled attribute values.

Exploitation Steps:

1. Identify a component that renders {{ attributes }} or uses only(), defaults(), without().
2. Inject a malicious payload into an attribute value (e.g., via a form field or URL parameter).
3. The payload will be rendered unsafely, executing JavaScript in the victim's browser.

Example Payload:

" onclick="alert('XSS')" autofocus="

Proof-of-Concept (PoC) Code:

{# vulnerable_component.html.twig #}
<div {{ attributes }}>
    {{ content }}
</div>

If attributes contains user input, the above renders unsafely.

Blue Team

Detection:

• Monitor for unusual attribute values in HTTP requests/responses.
• Use WAF rules to block common XSS payloads in attribute contexts.

Mitigation:

• Immediately upgrade to version 2.25.1.
• As a workaround, use {{ attributes.render('name') }} for safe output of individual attributes.
• Sanitize all user input before passing to component attributes.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing suspicious attribute values (e.g., onclick=, onerror=, javascript:).
  • Responses with unescaped HTML attributes in Symfony component output.

• File IOCs:

  • composer.json showing symfony/ux-twig-component version < 2.25.1.
  • symfony/ux-live-component version < 2.25.1.

• Log IOCs:

  • Application logs showing unusual attribute values in component rendering.

Detection Engineering

YARA Rule

rule CVE_2025_47946_Symfony_XSS {
    meta:
        description = "Detects vulnerable Symfony UX component versions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47946"
    strings:
        $vuln_version = /"symfony\/ux-twig-component":\s*"[0-9]+\.[0-9]+\.[0-9]+"/ 
        $vuln_live = /"symfony\/ux-live-component":\s*"[0-9]+\.[0-9]+\.[0-9]+"/
    condition:
        $vuln_version and not ($vuln_version contains "2.25.1") or
        $vuln_live and not ($vuln_live contains "2.25.1")
}

Sigma Rule

title: CVE-2025-47946 - Symfony UX Component XSS
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation attempts of CVE-2025-47946 via unsanitized attribute values
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'onclick='
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-47946 Symfony UX XSS Attempt"; flow:to_server,established; content:"onclick="; http_uri; nocase; content:"onerror="; http_uri; nocase; content:"javascript:"; http_uri; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade symfony/ux-twig-component to version 2.25.1 or later.
2. Upgrade symfony/ux-live-component to version 2.25.1 or later.
3. If immediate upgrade is not possible, avoid rendering {{ attributes }} directly. Use {{ attributes.render('name') }} for safe output.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits of Symfony components.
• Use static analysis tools to detect unsafe output escaping.

Workaround Code:

{# Safe rendering of individual attributes #}
<div {{ attributes.render('class') }}>
    {{ content }}
</div>

Valters IT
This report is generated for educational and defensive purposes. Always verify with official sources.