CVE-2017-16790
Last modified
CVE-2017-16790 is a vulnerability of currently unknown severity. An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, the request handler classes of the Form component merge POST data and uploaded files data into one array. EPSS estimates a 1.55% chance of exploitation in the next 30 days.
Description
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, the request handler classes of the Form component merge POST data and uploaded files data into one array. This big array forms the data that are then bound to the form. At this stage there is no difference anymore between submitted POST data and uploaded files. A user can send a crafted HTTP request where the value of a "FileType" is sent as normal POST data that could be interpreted as a local file path on the server-side (for example, "file:///etc/passwd"). If the application did not perform any additional checks about the value submitted to the "FileType", the contents of the given file on the server could have been exposed to the attacker.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sensiolabs | Symfony | >= 2.7.0, <= 2.7.37 |
| Sensiolabs | Symfony | >= 2.8.0, <= 2.8.30 |
| Sensiolabs | Symfony | >= 3.2.0, <= 3.2.13 |
| Sensiolabs | Symfony | >= 3.3.0, <= 3.3.12 |
| Debian | Debian Linux | 9.0 |
References
- https://symfony.com/blog/cve-2017-16790-ensure-that-submitted-data-are-uploaded-filesIssue Tracking, Patch, Vendor Advisory
- https://www.debian.org/security/2018/dsa-4262Third Party Advisory
- https://symfony.com/blog/cve-2017-16790-ensure-that-submitted-data-are-uploaded-filesIssue Tracking, Patch, Vendor Advisory
- https://www.debian.org/security/2018/dsa-4262Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-16790?
How severe is CVE-2017-16790?
How do I fix CVE-2017-16790?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-16785Cacti 1.1.27 has reflected XSS via the PATH_INFO to host.php…
- CVE-2017-16786The Web Configuration Utility in Meinberg LANTIME devices wi…
- CVE-2017-16787The Web Configuration Utility in Meinberg LANTIME devices wi…
- CVE-2017-16788Directory traversal vulnerability in the "Upload Groupkey" f…
- CVE-2017-16789Cross-site scripting (XSS) vulnerability in Integration Matt…
- CVE-2017-1679IBM OpenPages GRC Platform 7.2, 7.3, 7.4, and 8.0 could allo…5.5
- CVE-2017-16792Stored cross-site scripting (XSS) vulnerability in "geminabo…6.1
- CVE-2017-16793The wav_convert2mono function in lib/wav.c in SWFTools 0.9.2…
- CVE-2017-16794The png_load function in lib/png.c in SWFTools 0.9.2 does no…
- CVE-2017-16796In SWFTools 0.9.2, the png_load function in lib/png.c does n…
- CVE-2017-16797In SWFTools 0.9.2, the png_load function in lib/png.c does n…
- CVE-2017-16798In CMS Made Simple 2.2.3.1, the is_file_acceptable function …5.4
Are you affected by CVE-2017-16790?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST