8000 Security Vulnerability - Cross-site Scripting · Issue #27987 · symfony/symfony · GitHub
[go: up one dir, main page]
Skip to content

Security Vulnerability - Cross-site Scripting #27987

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
om3rcitak opened this issue Jul 18, 2018 · 3 comments
Closed

Security Vulnerability - Cross-site Scripting #27987

om3rcitak opened this issue Jul 18, 2018 · 3 comments

Comments

@om3rcitak
Copy link
om3rcitak commented Jul 18, 2018 •
edited
Loading

Symfony Debug version(s) affected: 2.8.*|3.0.*

Injection Technical Details

URL: http://{domain}/{laravel_path}/_debugbar/open?op=get&id=om3rcitak&<scRipt>alert(21)<%2fscRipt>=om3rcitak
Parameter Type: Parameter Name
Attack Pattern: <scRipt>alert(21)<%2fscRipt>

Repro

$ composer create-project --prefer-dist laravel/laravel:5.2.*
$ cd laravel
$ composer require barryvdh/laravel-debugbar:~2.4
$ php artisan vendor:publish --provider="Barryvdh\Debugbar\ServiceProvider"
$ php artisan serve

and visit: http://{domain}/{laravel_path}/_debugbar/open?op=get&id=om3rcitak&<scRipt>alert(21)<%2fscRipt>=om3rcitak

Possible Solution

Actually your fix this vulnerability 4.* version but laravel 5.2.* using symfony/debug 2.8.|3.0.. Your should be same fix for 2.8.|3.0. versions.

I send pull-request for fix this vulnerability: symfony/debug@e48bda2

Notes: I am testing laravel-debugger latest version (2.4) for Laravel 5.2.*. This vulnerability not effected Laravel >= 5.3 or laravel-debugger >=3.0 because Laravel using different error page template for version 5.2 and 5.3.
om3rcitak added a commit to om3rcitak/debug that referenced this issue Jul 18, 2018
@om3rcitak
fix XSS vulnerability
e48bda2 
details: symfony/symfony#27987
This was referenced Jul 18, 2018
Closed
Closed
@xabbuh
Copy link
Member
xabbuh commented Jul 19, 2018

Please note that Symfony 3.0 does not receive any security updates anymore. But if you think that Symfony 2.8 is still affected by the bug, please open a PR in this repository.

Please also note to report security issues in the future via e-mail to security (at) symfony.com. In this case, that's not a big deal as the web debug toolbar should never be accessible to the users of your website.
8000

@fabpot
Copy link
Member
fabpot commented Jul 19, 2018

This bug was fixed a long time ago on all supported versions of Symfony. See #23684

@fabpot fabpot closed this as completed Jul 19, 2018
om3rcitak added a commit to om3rcitak/symfony that referenced this issue Jul 19, 2018
@om3rcitak
fix XSS vulnerability
1528786 
details: symfony#27987
This was referenced Jul 19, 2018
Closed
Closed
@abergmann
Copy link

CVE-2017-18343 was assigned to this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@fabpot @xabbuh @abergmann @om3rcitak
0