 Symfony Securitiy Issue - validation bypass method [message #5457] |
Tue, 25 April 2006 15:56  |
|
Synopsis
--------
Symfony's built in validation system can by bypassed by altering the case of a URL.
Affected Versions
-----------------
All current versions of symfony are affected.
Description
-----------
Symfony provides a system to validate actions by specifying rules in a configuration file whos name is dependent upon the requested action. Due to the case insensitivity of PHP coupled with the case sensitivity of the underlying file system, validation rules can by bypassed by changing the case of the action in the URL.
Example
-------
http://site.com/module/action/id/4 - might be validated by a file called 'validate/action.yml'. However, changing the URL to
http://site.com/module/acTIOn/id/4 would bypass the validation (validate/acTiOn.yml would not exist)
Impact
------
The impact of this issue will vary on an application to application basis. For applications relying on validation to sanitize data – unsanitized data could be injected into your site. Some applications might be using the validation system for permissions checking, this issue will allow users to bypass your sites security.
Workaround
----------
Currently there is no known work around.
[Updated on: Tue, 25 April 2006 16:10]
http://shurl.net - the only URL shortening service written with symfony!
|
|
|
|
|
|
|
|
| Re: Symfony Securitiy Issue - validation bypass method [message #5475 is a reply to message #5457 ] |
Tue, 25 April 2006 21:29  |
|
Do you realise that 'site.com', 'module' and 'action' are all just examples? If you still fail to understand this, talk to me on IRC, you must be having a blonde moment.
http://shurl.net - the only URL shortening service written with symfony!
|
|
|
|
| Re: Symfony Securitiy Issue - validation bypass method [message #5483 is a reply to message #5457 ] |
Tue, 25 April 2006 22:37 |
|
I'm showing URLs that aren't using the routing engine to help explain things a little better.
http://bbs.pookey.co.uk/board/view?short_code=board1
In this action, short_code is a required parameter. If it's not supplied, validation notices and kicks out an error, for example:
http://bbs.pookey.co.uk/board/view?short_code=
however, try this:
http://bbs.pookey.co.uk/board/vIEw?short_code=
This page returns a 404, because the query is doing a
$this->forward404Unless($board = BoardPeer::doSelectOne($c)); is failing to return a board, because the short_code wasn't passed. As you can see, validation was completly bypassed.
It's clearer if you look at the debug helper here:
http://bbs.pookey.co.uk/bbs_dev.php/board/vIEw?short_code=
Hope this explains it better.
BTW: blonde moment - blond(e) people are often called stupid, having a blonde moment is a moment of stupidity  (I'm allowed to say this, I'm blond myself  )
[Updated on: Tue, 25 April 2006 22:38]
http://shurl.net - the only URL shortening service written with symfony!
|
|
|
|
| Re: Symfony Securitiy Issue - validation bypass method [message #6608 is a reply to message #5457 ] |
Wed, 24 May 2006 18:14 |
 halfer
Messages: 9535
Registered: January 2006
Location: West Midlands, UK |
Faithful Member |
|
|
If you are using Apache and mod_rewrite, I wonder if the internal lowercase mapping function could be used to lowercase all URLs at the server end?
This would certainly fix the security hole, though of course the core problem would still need to be addressed at some point in symfony.
Remember Palestine
|
|
|
|
|
|
|
|
|
| Re: Symfony Securitiy Issue - validation bypass method [message #15958 is a reply to message #5457 ] |
Wed, 15 November 2006 11:07 |
halfer
Messages: 9535
Registered: January 2006
Location: West Midlands, UK |
Faithful Member |
|
|
The ticket is closed. Could you let us know which version you are using, and any other relevant info about your environment, so bugfixers can determine what might need fixing?
Remember Palestine
|
|
|
|
| Re: Symfony Securitiy Issue - validation bypass method [message #15964 is a reply to message #5457 ] |
Wed, 15 November 2006 11:56 |
halfer
Messages: 9535
Registered: January 2006
Location: West Midlands, UK |
Faithful Member |
|
|
AFAIK this was fixed before 0.7.1914. I am running that version too, and this fix is already on mine. Is it on yours?
Remember Palestine
|
|
|
|
|
Members
Search
FAQ
Register
Login
Home
