API Platform Core Exception Message Leak in JSON Error Response

A vulnerability exists in API Platform Core versions 3.2.0 prior to 3.2.5, where exception messages, excluding HTTP exceptions, are exposed in the JSON error response. This issue arises from an improper handling of exceptions while attempting to align with the JSON Problem specification, leading to the serialization of sensitive exception details that should have been managed by Symfony. Although the stack trace is omitted in production, the exception message can reveal sensitive information.

Impact

The vulnerability allows for the unintentional disclosure of exception messages in the JSON error response, which may contain sensitive information.

Reproduction

To reproduce this vulnerability, use API Platform Core version 3.2.0 through 3.2.4. Trigger an exception that is not an HTTP exception, such as an authentication exception due to unreachable LDAP, and observe the JSON response, which will include the exception message.

Remediation

Users can upgrade to API Platform Core version 3.2.5 to address this vulnerability.