Symfony Url Generator Dot-Segment Encoding Vulnerability Allows Path Manipulation

A vulnerability exists in the Symfony framework's UrlGenerator component, specifically in the doGenerate() method, prior to versions 5.4.53, 6.4.41, 7.4.13, and 8.0.13. The issue arises from improper handling of dot-segment encoding in URL generation, which can be exploited to manipulate route parameters. The encoding method used, strtr(), failed to correctly process chained '../' or './' segments, allowing attacker-controlled inputs to generate URLs that, after normalization according to RFC 3986, resolved to unintended paths. This flaw can disrupt route integrity, particularly when routes accept dots and slashes in parameters.

Impact

Exploitation of this vulnerability can lead to route manipulation, causing generated URLs to resolve to incorrect paths, thereby disrupting application routing and potentially leading to unauthorized access or actions.

Reproduction

To reproduce this vulnerability, create a route that includes a parameter accepting dot-segments, such as one constrained by a requirement that allows dots and slashes. Then, use the UrlGenerator to generate a URL for this route, including chained '../' or './' segments in the parameter. The generated URL will incorrectly collapse under RFC 3986 normalization, demonstrating the vulnerability.

Remediation

Users can update to Symfony versions 5.4.53, 6.4.41, 7.4.13, or 8.0.13 to address this vulnerability.