HTTP Request Manipulation Vulnerability in Symfony by Sensio Labs

CVE-2018-14773

What is CVE-2018-14773?

A vulnerability was identified in the Http Foundation component of Symfony that permits a misuse of HTTP request headers, specifically the X-Original-URL and X-Rewrite-URL headers. These headers, while intended for Internet Information Services (IIS) compatibility, do not verify the server context, allowing any user capable of sending crafted requests to exploit the weakness. This manipulation can potentially lead to unauthorized actions, such as web cache poisoning. The issue has since been addressed by removing support for these headers, thereby closing this vector of attack.

References