Host Header Injection Vulnerability in Symfony HttpKernel

CVE-2018-14774

Summary

A vulnerability in Symfony's HttpKernel allows for host header injection when using HttpCache. Specifically, the X-Forwarded-Host headers are treated as trusted without proper validation, opening the door to potential security breaches where an attacker could manipulate the request's Host header to redirect requests or bypass security controls. This issue affects multiple versions of Symfony, and it is critically important for users to validate the headers properly to prevent exploitation.

References