NVD Vulnerability Detail

CVE-2021-41267

Summary	Symfony/Http-Kernel is the HTTP kernel component for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Headers that are not part of the "trusted_headers" allowed list are ignored and protect users from "Cache poisoning" attacks. In Symfony 5.2, maintainers added support for the `X-Forwarded-Prefix` headers, but this header was accessible in SubRequest, even if it was not part of the "trusted_headers" allowed list. An attacker could leverage this opportunity to forge requests containing a `X-Forwarded-Prefix` header, leading to a web cache poisoning issue. Versions 5.3.12 and later have a patch to ensure that the `X-Forwarded-Prefix` header is not forwarded to subrequests when it is not trusted.
Publication Date	Nov. 25, 2021, 4:15 a.m.
Registration Date	Nov. 25, 2021, 10 a.m.
Last Update	Nov. 21, 2024, 3:25 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:sensiolabs:symfony::::::::		5.2.0			5.3.12

Related information, measures and tools

No	URL	タグ
1	https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487	Patch Third Party Advisory
2	https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487	Patch Third Party Advisory
3	https://github.com/symfony/symfony/pull/44243	Patch Third Party Advisory
4	https://github.com/symfony/symfony/pull/44243	Patch Third Party Advisory
5	https://github.com/symfony/symfony/releases/tag/v5.3.12	Release Notes Third Party Advisory
6	https://github.com/symfony/symfony/releases/tag/v5.3.12	Release Notes Third Party Advisory
7	https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q	Patch Third Party Advisory
8	https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q	Patch Third Party Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Symfony における HTTP リクエストスマグリングに関する脆弱性

Title	Symfony における HTTP リクエストスマグリングに関する脆弱性
Summary	Symfony には、 HTTP リクエストスマグリングに関する脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 24, 2021, midnight
Registration Date	Nov. 16, 2022, 3:14 p.m.
Last Update	Nov. 16, 2022, 3:14 p.m.

Affected System

Sensio Labs

Symfony 5.2 以上 5.3.12 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2021-41267	https://www.cve.org/CVERecord?id=CVE-2021-41267
National Vulnerability Database (NVD)
2	CVE-2021-41267	https://nvd.nist.gov/vuln/detail/CVE-2021-41267

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-444	https://cwe.mitre.org/data/definitions/444.html

ベンダー情報

No	Name	URL
GitHub
1	Fix missing extra trusted header in sub-request	https://github.com/symfony/symfony/commit/95dcf51682029e89450aee86267e3d553aa7c487
2	Release v5.3.12 #44243	https://github.com/symfony/symfony/pull/44243
3	v5.3.12	https://github.com/symfony/symfony/releases/tag/v5.3.12
4	Webcache Poisoning via X-Forwarded-Prefix and sub-request	https://github.com/symfony/symfony/security/advisories/GHSA-q3j3-w37x-hq2q

Change Log

No	Changed Details	Date of change
1	[2022年11月16日] 掲載	Nov. 16, 2022, 3:14 p.m.