Vulnerability Name:

CVE-2018-14773 (CCN-147835)

Assigned:2018-08-01
Published:2018-08-01
Updated:2021-09-29
Summary:An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
CVSS v3 Severity:6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
6.5 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): High
Availibility (A): None
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
7.8 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Complete
Availibility (A): None
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2018-14773

Source: CCN
Type: SECTRACK ID: 1041405
Drupal Access Control Flaw in Symfony HttpFoundation Component Lets Remote Users Bypass Security Restrictions on the Target System

Source: BID
Type: Third Party Advisory, VDB Entry
104943

Source: CCN
Type: BID-104943
Symfony CVE-2018-14773 Security Bypass Vulnerability

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1041405

Source: XF
Type: UNKNOWN
drupal-cve201814773-sec-bypass(147835)

Source: CONFIRM
Type: Issue Tracking, Patch, Third Party Advisory
https://github.com/symfony/symfony/commit/e447e8b92148ddb3d1956b96638600ec95e08f6b

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20190310 [SECURITY] [DLA 1707-1] symfony security update

Source: BUGTRAQ
Type: Issue Tracking, Mailing List, Third Party Advisory
20190510 [SECURITY] [DSA 4441-1] symfony security update

Source: CONFIRM
Type: Patch, Vendor Advisory
https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and-risky-http-headers

Source: DEBIAN
Type: Third Party Advisory
DSA-4441

Source: CCN
Type: SA-CORE-2018-005
Drupal Core - 3rd-party libraries

Source: CONFIRM
Type: Patch, Third Party Advisory
https://www.drupal.org/SA-CORE-2018-005

Source: CCN
Type: IBM Security Bulletin 719697 (API Connect)
IBM API Connect is impacted by a Drupal 8 vulnerability (CVE-2018-14773)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:sensiolabs:symfony:*:*:*:*:*:*:*:* (Version > 2.7.0 and <= 2.7.48)
  • OR cpe:/a:sensiolabs:symfony:*:*:*:*:*:*:*:* (Version >= 3.4.0 and <= 3.4.13)
  • OR cpe:/a:sensiolabs:symfony:*:*:*:*:*:*:*:* (Version >= 4.0.0 and <= 4.0.13)
  • OR cpe:/a:sensiolabs:symfony:*:*:*:*:*:*:*:* (Version >= 4.1.0 and <= 4.1.2)
  • OR cpe:/a:sensiolabs:symfony:*:*:*:*:*:*:*:* (Version >= 2.8.0 and <= 2.8.43)
  • OR cpe:/a:sensiolabs:symfony:*:*:*:*:*:*:*:* (Version >= 3.3.0 and <= 3.3.17)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:9.0:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/a:drupal:drupal:*:*:*:*:*:*:*:* (Version >= 8.0.0 and < 8.5.6)

    • Configuration CCN 1:
  • cpe:/a:drupal:drupal:8.5.5:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:api_connect:2018.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:api_connect:2018.3.4:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:com.ubuntu.bionic:def:201814773000
    V
    		CVE-2018-14773 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-08-03
    oval:com.ubuntu.bionic:def:2018147730000000
    V
    		CVE-2018-14773 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-08-03
    oval:com.ubuntu.cosmic:def:201814773000
    V
    		CVE-2018-14773 on Ubuntu 18.10 (cosmic) - medium.
    2018-08-03
    oval:com.ubuntu.xenial:def:2018147730000000
    V
    		CVE-2018-14773 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-08-03
    oval:com.ubuntu.xenial:def:201814773000
    V
    		CVE-2018-14773 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-08-03
    oval:com.ubuntu.disco:def:2018147730000000
    V
    		CVE-2018-14773 on Ubuntu 19.04 (disco) - medium.
    2018-08-03
    oval:com.ubuntu.cosmic:def:2018147730000000
    V
    		CVE-2018-14773 on Ubuntu 18.10 (cosmic) - medium.
    2018-08-03
    BACK
    sensiolabs symfony *
    sensiolabs symfony *
    sensiolabs symfony *
    sensiolabs symfony *
    sensiolabs symfony *
    sensiolabs symfony *
    debian debian linux 8.0
    debian debian linux 9.0
    drupal drupal *
    drupal drupal 8.5.5
    ibm api connect 2018.1.0
    ibm api connect 2018.3.4