Symfony Url Sanitizer BiDi Character Handling Vulnerability

A vulnerability exists in the Symfony framework's UrlSanitizer component, specifically in versions 6.1.0 prior to 6.4.41, 7.4.13, and 8.0.13. The issue arises because the UrlSanitizer::parse() method fails to properly reject percent-encoded Bidirectional (BiDi) formatting characters and uses an inadequate whitespace check. This oversight allows sanitized URLs to retain visual-spoofing characters, which can be decoded and displayed by downstream consumers, potentially leading to phishing or other security risks.

Impact

Exploitation of this vulnerability allows for the introduction of visual-spoofing characters in URLs, which can be decoded and displayed by users or systems, undermining the integrity of URL handling and potentially facilitating phishing attacks.

Reproduction

The vulnerability can be reproduced by using the UrlSanitizer::parse() method with URLs that include percent-encoded BiDi characters or Unicode whitespace. The method will incorrectly process these URLs, allowing the BiDi characters to remain in the sanitized output.

Remediation

Users can upgrade to Symfony versions 6.4.41, 7.4.13, or 8.0.13, where this vulnerability has been fixed.