Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.3
CVE-2024-50345: Symfony HTTP Foundation can be tricked into open redirect
CVE-2024-50345 · published 1 year ago
Summary
The Request component in Symfony's HTTP Foundation library does not handle special characters in URLs the same way browsers do, allowing a malicious link to send users to a different website. This can be used to bypass validation and redirect visitors without their knowledge. Upgrade to the latest patched versions of the affected packages to eliminate the risk.
What to do
- Update symfony http-foundation to version 5.4.46.
- Update symfony http-foundation to version 6.4.14.
- Update symfony http-foundation to version 7.1.7.
- Update debian symfony to version 5.4.23+dfsg-1+deb12u3.
- Update debian symfony to version 6.4.14+dfsg-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | symfony | http-foundation |
< 5.4.46 >= 6.0.0, < 6.4.14 >= 7.0.0, < 7.1.7 Fix: upgrade to 5.4.46
|
| – | sensiolabs | symfony |
< 5.4.46 >= 6.0.0, < 6.4.14 >= 7.0.0, < 7.1.7 cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:* |
| Debian:12 | debian | symfony |
< 5.4.23+dfsg-1+deb12u3 Fix: upgrade to 5.4.23+dfsg-1+deb12u3
|
| Debian:13 | debian | symfony |
< 6.4.14+dfsg-1 Fix: upgrade to 6.4.14+dfsg-1
|
Original advisory text
Open redirect via browser-sanitized URLs in symfony/http-foundation
symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters the same way browsers do. As a result, an attacker can trick a validator relying on the `Request` class to redirect users to another domain. The `Request::create` methods now assert the URI does not contain invalid characters as defined by https://url.spec.whatwg.org/. This issue has been patched in versions 5.4.46, 6.4.14, and 7.1.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References
- https://github.com/symfony/symfony/commit/5a9b08e5740af795854b1b639b7d45b9cbfe88...
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-fou...
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/...
- https://symfony.com/cve-2024-50345
- https://github.com/advisories/GHSA-mrqx-rp3w-jpjp
- https://lists.debian.org/debian-lts-announce/2025/05/msg00051.html URL
- https://url.spec.whatwg.org URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/50xxx/CVE-2024-50345... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-50345 Vendor Advisory
- https://security-tracker.debian.org/tracker/CVE-2024-50345 Vendor Advisory
- https://github.com/symfony/symfony/security/advisories/GHSA-mrqx-rp3w-jpjp Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-601Open Redirect
Timeline
Published6 Nov 2024
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-mrqx-rp3w-jpjp · GHSA
CVE-2024-50345 · NVD
CVE-2024-50345 · OSV
DEBIAN-CVE-2024-50345 · OSV
Track software like this
Free during beta