Path Traversal in Symfony UX

Executive Summary

This vulnerability exists in Symfony UX, a JavaScript ecosystem for Symfony, specifically in the ux:install console command versions from 2.32.0 before 2.36.1 and from 3.0.0 before 3.2.0.

The command installs files from a recipe kit by copying paths listed in a copy-files map. However, because the Path::isRelative() function accepts paths like ../../../etc, a crafted or compromised recipe kit can exploit this to write attacker-controlled content to arbitrary locations or read local files outside the intended recipe directory.

This means an attacker can potentially manipulate the file system by reading or writing files outside the allowed scope during the installation process.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have serious impacts including unauthorized reading of sensitive local files and writing of malicious or attacker-controlled files to arbitrary locations on the system.

Such actions can lead to compromise of confidentiality, integrity, and availability of the system.

Specifically, an attacker could use this to escalate privileges, implant malware, or exfiltrate sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Symfony UX to version 2.36.1 or later if you are using the 2.x series, or to version 3.2.0 or later if you are using the 3.x series.

Avoid using the ux:install console command with untrusted or compromised recipe kits, as they may exploit the path traversal issue to write or read arbitrary files.

Useful 0 Not Useful 0