CVE-2025-64500

Executive Summary

CVE-2025-64500 is a high-severity access control bypass vulnerability in the Symfony HttpFoundation component, affecting all versions from 2.0.0 up to (but not including) 5.4.50, 6.4.29, and 7.3.7. The vulnerability arises from improper parsing of PATH_INFO in the Request class, which can produce URL paths that do not start with a forward slash (/). This deviation from the expected path format allows attackers to bypass access control rules that rely on the assumption that all paths begin with /. The vulnerability has a CVSS score of 7.3 and is exploitable remotely without authentication. A public proof-of-concept exists via a Nuclei template, and the EPSS score is currently 0.0%, indicating low exploitation activity in the wild. The vendor has released patches in the specified versions.

Supply Chain & Package Security

This vulnerability affects the symfony/http-foundation package, which is a core component of the Symfony framework and is widely distributed via Composer (Packagist). Organizations using Symfony should treat this as a high-priority update due to the potential for access control bypass in web applications. The package is a direct dependency for many Symfony projects, and transitive dependencies may also be affected. Ensure that all projects using Symfony are updated to the patched versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 7.3 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and impacted component are the same.
• Confidentiality Impact: Low (C:L) – Limited information disclosure possible.
• Integrity Impact: Low (I:L) – Limited modification of data possible.
• Availability Impact: Low (A:L) – Limited denial of service possible.

Threat Level: High. The vulnerability allows bypassing access controls, which can lead to unauthorized access to restricted resources. Although the EPSS score is currently 0.0%, the public availability of a Nuclei template increases the risk of automated scanning.

Deep Dive & Mechanics

The vulnerability resides in the Request class of the Symfony HttpFoundation component. The Request class is responsible for parsing incoming HTTP requests, including the PATH_INFO server variable. PATH_INFO contains the path after the script name in a CGI environment (e.g., /index.php/some/path). The flawed logic in the Request class improperly handles certain PATH_INFO values, resulting in a path that does not begin with /.

For example, a request to /index.php/admin might be parsed as admin instead of /admin. Access control rules that check for a leading / (e.g., strpos($path, '/admin') === 0) would fail to match, allowing the attacker to bypass the restriction. This is a classic example of a path normalization inconsistency.

The root cause is a missing normalization step that ensures the final path always starts with /. The fix adds a check to prepend / if the path does not already start with it.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

// In Request::createFromGlobals() or similar
$pathInfo = $_SERVER['PATH_INFO'] ?? '';
// No normalization of leading slash
$this->pathInfo = $pathInfo;

Patched Code (simplified):

// In Request::createFromGlobals() or similar
$pathInfo = $_SERVER['PATH_INFO'] ?? '';
// Ensure path starts with /
if ('' !== $pathInfo && '/' !== $pathInfo[0]) {
    $pathInfo = '/' . $pathInfo;
}
$this->pathInfo = $pathInfo;

The patch ensures that any non-empty PATH_INFO value is prepended with / if it does not already start with one. This prevents the access control bypass.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Symfony application running a vulnerable version (e.g., 5.4.49).
• The application must have access control rules that check for a leading / in the path.
• The application must be configured to use a front controller (e.g., index.php).

Exploitation Steps:

1. Identify a vulnerable endpoint: Look for routes that are protected by access control rules that check for a leading /. For example, an admin panel at /admin.

2. Craft a malicious request: Send a request where the PATH_INFO does not start with /. This can be achieved by manipulating the URL path after the script name.

   Example request:

   GET /index.phpadmin HTTP/1.1
   Host: target.com
   

   In this case, the PATH_INFO might be parsed as admin instead of /admin.

3. Bypass access control: If the access control rule checks for /admin at the start of the path, it will fail to match admin, allowing the attacker to access the admin panel.

Nuclei Template (Provided):

id: CVE-2025-64500

info:
  name: Symfony HttpFoundation - Access Control Bypass via PATH_INFO
  author: DhiyaneshDk
  severity: high
  description: |
    Symfony HttpFoundation component >= 2.0.0 and prior to versions 5.4.50, 6.4.29, and 7.3.7 contains an access control bypass vulnerability. The Request class improperly interprets some PATH_INFO values, producing URL paths without a leading `/`. This allows bypassing access control rules that are built with the `/-prefix` assumption.
  impact: |
    Attackers can bypass access control rules, potentially gaining unauthorized access to restricted resources.
  remediation: Update to Symfony versions 5.4.50, 6.4.29, or 7.3.7 or later.
  reference:
    - https://github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm
    - https://symfony.com/blog/cve-2025-64500-incorrect-parsing-of-path-info-can-lead-to-limited-authorization-bypass
    - https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac
    - https://nvd.nist.gov/vuln/detail/CVE-2025-64500
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cve-id: CVE-2025-64500
    cwe-id: CWE-647
    epss-score: 0.02607
    epss-percentile: 0.85695
  metadata:
    verified: true
    max-request: 2
    vendor: sensiolabs
    product: symfony
    shodan-query: cpe:"cpe:2.3:a:sensiolabs:symfony"
  tags: cve,cve2025,symfony,auth-bypass

http:
  - raw:
      - |
        GET /{{front_controller}}_profiler/ HTTP/1.1
        Host: {{Hostname}}

    payloads:
      front_controller:
        - "index.php"
        - "app.php"

    stop-at-first-match: true

    matchers:
      - type: word
        part: body
        words:
          - "Symfony Profiler"
          - "<title>Profiler</title>"
          - "Symfony-Debug-Toolbar"
        condition: or

Usage: Run the Nuclei template against the target to detect the vulnerability. The template checks for the Symfony Profiler page, which is often exposed and can be accessed via the vulnerable path parsing.

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for requests with unusual path structures, such as paths that do not start with / or paths that appear to be missing the leading slash.
• Look for requests to protected resources (e.g., /admin) that are accessed via alternative path representations (e.g., admin without the leading slash).
• Use the provided Sigma and Suricata rules to detect exploitation attempts.

Mitigation:

• Immediately update Symfony to version 5.4.50, 6.4.29, or 7.3.7 or later.
• If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to normalize paths before they reach the application. For example, ensure that all paths start with /.
• Review and harden access control rules to not rely solely on path prefix checks. Use robust authentication and authorization mechanisms.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with PATH_INFO that does not start with / (e.g., GET /index.phpadmin).
  • Requests to the Symfony Profiler page (/_profiler/) from unexpected sources.
• File IOCs:
  • Log entries showing access to protected resources via non-standard paths.
• Behavioral IOCs:
  • Unauthorized access to admin panels or other restricted areas.
  • Anomalous patterns in web server access logs.

Detection Engineering

YARA Rule

rule CVE_2025_64500_Symfony_Path_Info_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2025-64500 by looking for PATH_INFO without leading slash"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-64500"
        severity = "high"
    strings:
        $path_info = /PATH_INFO[^\\n]*?[^\\/]/
        $access_log = /GET \\/[^\\/]/
    condition:
        $path_info or $access_log
}

Sigma Rule

title: Symfony HttpFoundation Access Control Bypass via PATH_INFO
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests where PATH_INFO does not start with a forward slash, indicating exploitation of CVE-2025-64500.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-64500
    - https://github.com/symfony/symfony/security/advisories/GHSA-3rg7-wf37-54rm
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-stem|re: '^/[^/]'  # Path does not start with /
    condition: selection
falsepositives:
    - Legitimate requests with unusual path structures (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64500 Symfony HttpFoundation Access Control Bypass"; flow:to_server,established; content:"GET"; http_method; content:"/"; http_uri; distance:0; pcre:"/^\\/[^\\/]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Update Symfony to version 5.4.50, 6.4.29, or 7.3.7 or later. Run composer update symfony/symfony or composer update symfony/http-foundation.
2. WAF Rules: Deploy WAF rules to normalize paths and block requests where PATH_INFO does not start with /.
3. Access Control Review: Audit all access control rules to ensure they are robust and do not rely solely on path prefix checks.

Long-Term Measures:

• Implement regular dependency scanning and automated patching.
• Use a Web Application Firewall (WAF) with virtual patching capabilities.
• Conduct regular security training for developers on common path traversal and normalization issues.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact threatintel@valtersit.com.

{/* [Security Hash: 01E420B23529B9E7D9EE9EF2] */}