Symfony UrlAttributeSanitizer Missing URL Validation Leads to XSS Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the Symfony framework, specifically in the UrlAttributeSanitizer component of the HtmlSanitizer. This issue affects Symfony versions 6.1.0-BETA1 prior to 6.4.40, as well as versions 7.4.12 and 8.0.12. The vulnerability arises because the UrlAttributeSanitizer's method getSupportedAttributes() fails to include several URL-valued attributes, such as action, formaction, poster, and cite. As a result, configurations that allow these attributes can inadvertently permit javascript: URIs to remain unsanitized. When the rendered HTML is interacted with, such as by submitting a form or clicking a button, this oversight can be exploited to execute malicious scripts.

Impact

Exploitation of this vulnerability allows for cross-site scripting (XSS) attacks, where an attacker can inject and execute malicious scripts in the context of the user's browser.

Reproduction

To reproduce this vulnerability, create a Symfony application that uses the HtmlSanitizer component. Configure the sanitizer to allow forms and the relevant URL-valued attributes (action, formaction, poster, or cite) without proper validation. For example, a form can be set to allow the action attribute with a permissive configuration that does not sanitize javascript: URIs. Once the configuration is in place, the form can be submitted, triggering the XSS vulnerability by executing the injected script.

Remediation

Users can update to Symfony versions 6.4.40, 7.4.12, or 8.0.12, where this vulnerability has been fixed.