AIKIDO-2024-10381
symfony/form is vulnerable to Improper Neutralization of Null Byte
25
Low Risk
This Affects:
symfony/formTL;DR
Affected versions of this package are vulnerable to null byte injection. In PHP 7, the DateTime::createFromFormat function allows null byte injection, while in PHP 8, it throws a ValueError that is not properly caught. This vulnerability can allow attackers to manipulate date and time input, potentially leading to unexpected behavior or security issues. The fix addresses this by preventing null byte injection in PHP 7.x by throwing a TransformationFailedException, ensuring proper input validation and safeguarding against such attacks.
Who does this affect?
You are affected if you are using a version which is within vulnerability ranges and you are not using PHP 8.
Background info
symfony/form is vulnerable to Improper Neutralization of Null Byte in versions 2.0.0 - 5.4.37, 6.0.0 - 6.4.5 and 7.0.0 - 7.0.5.
How to fix this
Upgrade the symfony/form library to a patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant