Symfony Method-Scoped Attributes HEAD Request Bypass Vulnerability

A vulnerability exists in Symfony's method-scoped attributes #[IsGranted], #[IsSignatureValid], and #[IsCsrfTokenValid] in versions prior to 7.4.12 and 8.0.12. These attributes can be configured to apply only to GET requests. However, Symfony routes HEAD requests to the GET handler while skipping the attribute checks. This oversight allows protected controllers to execute, potentially leaking headers or causing other side effects.

Impact

Exploiting this vulnerability can lead to unauthorized access to protected controller actions, allowing for the execution of code that could leak sensitive headers or perform unintended side effects, such as database writes or state changes.

Reproduction

To reproduce this vulnerability, apply a method filter to a controller action using the #[IsGranted], #[IsSignatureValid], or #[IsCsrfTokenValid] attributes, specifying 'GET' as the allowed method. Then, send a HEAD request to the route. The request will be processed as a GET, but the attribute checks will be bypassed, allowing the action to execute without proper authorization.

Remediation

Users can update to Symfony versions 7.4.12 or 8.0.12, where this vulnerability has been fixed.