Stored XSS in Symfony UX JavaScript Ecosystem

Compliance Impact

The vulnerability allows cross-site scripting (XSS) attacks through unsanitized SVG content, which can lead to unauthorized execution of malicious scripts in users' browsers.

Such XSS vulnerabilities can compromise the confidentiality and integrity of user data, potentially leading to data breaches or unauthorized data access.

This can negatively impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and attacks.

Therefore, organizations using affected versions of Symfony UX Icons may face increased risk of non-compliance if the vulnerability is not remediated.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Symfony UX, a JavaScript ecosystem for Symfony, specifically in the ux_icon() Twig function and Icon::toHtml() method. These functions inline SVG source code verbatim and mark the output as safe HTML without sanitization. This allows malicious SVG files or JSON responses containing nested script elements, event handlers, or dangerous URL schemes to execute cross-site scripting (XSS) attacks.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to cross-site scripting (XSS) attacks, where an attacker can execute arbitrary scripts in the context of the affected web application. This can result in the theft of user credentials, session hijacking, defacement of the website, or the execution of malicious actions on behalf of the user.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Symfony UX to version 2.36.1 or later if you are using the 2.x series, or to version 3.2.0 or later if you are using the 3.x series.

These versions fix the issue where the ux_icon() Twig function and Icon::toHtml() inline SVG source verbatim, which could allow cross-site scripting via unsanitized local SVG files or Iconify JSON responses.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves unsanitized SVG content being rendered by the Symfony UX Icons component, which can lead to cross-site scripting (XSS) attacks. Detection involves identifying usage of vulnerable versions of symfony/ux-icons (>=2.17.0 <2.36.1 and >=3.0.0 <3.2.0) and checking for SVG files or Iconify JSON responses containing dangerous elements or attributes such as <script> tags, on* event handlers, or unsafe URL schemes.

To detect potentially malicious SVG content on your system, you can scan your local SVG files or cached icon data for suspicious elements or attributes. For example, you can use command-line tools like grep or find to search for script tags or event handlers within SVG files.

• Find SVG files containing <script> tags: grep -r --include='*.svg' '<script' /path/to/svg/files
• Search for event handler attributes (e.g., onload, onclick) in SVG files: grep -r --include='*.svg' 'on[a-z]*=' /path/to/svg/files
• Check for unsafe URL schemes in href or xlink:href attributes: grep -r --include='*.svg' -E 'href=["\'](javascript:|vbscript:|data:text/html)' /path/to/svg/files

Additionally, if you use Iconify on-demand JSON responses, monitor network traffic or cached JSON icon data for similar patterns containing script elements or event handlers.

Upgrading to patched versions (2.36.1 and 3.2.0) and clearing icon caches is recommended to mitigate this vulnerability.

Useful 0 Not Useful 0