Symfony and Symfony Components Yaml Collection Alias Resolution Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in the Symfony YAML component, specifically in versions prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12. The issue arises in the 'Symfony\Component\Yaml\Parser' class, where YAML collection aliases are resolved recursively. This recursive resolution allows a small, untrusted YAML input to expand into a multi-gigabyte structure, exhausting memory resources. The vulnerability is akin to the 'Billion Laughs' attack, targeting any parser that processes untrusted YAML.

Impact

Exploitation of this vulnerability leads to excessive memory consumption, causing a denial-of-service condition by exhausting available system resources.

Reproduction

The vulnerability can be reproduced by crafting a YAML document that uses collection aliases to reference other collections, creating a recursive loop. This can be done by, for example, having an alias point to a collection that contains another alias, which in turn points back to the original collection. When parsed, this creates an exponential growth in the data structure, consuming large amounts of memory.

Remediation

Users can upgrade to Symfony versions 5.4.52, 6.4.40, 7.4.12, or 8.0.12, where this vulnerability has been fixed. The parser has been modified to limit the number of resolved collection aliases to prevent such recursive exploitation.