Symfony Twig Bridge Web Profiler Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the Symfony Twig Bridge's Web Profiler component. This issue affects Symfony versions 6.4.24 prior to 6.4.40, 7.2.9 prior to 7.4.12, and 8.0.12. The vulnerability arises because the 'file_excerpt' Twig filter in the Web Profiler's CodeExtension improperly handles non-PHP files. While PHP files are correctly escaped, lines from non-PHP files are interpolated directly into code elements without escaping. This flaw allows an attacker to inject malicious scripts into files that, when opened by a developer in the profiler, execute the injected scripts, leading to cross-site scripting.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the profiled file.

Reproduction

To reproduce this vulnerability, write a script into a non-PHP file, such as 'var/log/dev.log', that includes JavaScript code. When this file is opened in the Symfony Web Profiler, the JavaScript will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users can upgrade to Symfony versions 6.4.40, 7.4.12, or 8.0.12 to address this vulnerability.