Websites developed using the Symfony framework were found to be vulnerable to web cache poisoning attacks due to incorrect processing of HTTP headers. Symfony is one of the most popular PHP frameworks for web applications, with over 200 million downloads. The Symfony vulnerability could have led to the leakage of confidential data, including users’ IP addresses.
Cache poisoning attacks target intermediate servers such as proxies, points of presence (PoPs), and load balancers. These systems speed up websites by storing local copies of content for quick response to clients. However, attackers can inject malicious data into the cache, which is then passed on to other users.
The problem manifested itself when a Symfony site was running behind a proxy or load balancer. In such cases, developers could configure Symfony to use X-Forwarded-* headers, which transmit client information such as the source IP, port, or protocol.
To protect against such attacks, Symfony uses a trusted_headers_allowlist that restricts the processing of acceptable headers. Starting with version 5.2, developers added support for the X-Forwarded-Prefix header, which reports the path of the original request. However, a vulnerability arose in the sub-request mechanism, which allows only part of a page to be rendered and returned.
Although X-Forwarded-Prefix was not included in the list of trusted headers, it was processed by sub-requests. This allowed attackers to form malicious sub-requests with this header and save them in the cache. As a result, users could receive substituted content.
Similar issues have already been fixed in at least one Symfony-based e-commerce platform. The exact number of affected projects is unknown, but given the popularity of the framework, the consequences could be quite significant.