Crítica

Remote Code Execution in SyliusResourceBundle

Publicada: 19.08.2020
Actualizado: 11.10.2026 10:22

Impact

Request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution.

The vulnerable versions include: <=1.3.13 || >=1.4.0 <=1.4.6 || >=1.5.0 <=1.5.1 || >=1.6.0 <=1.6.3.

Example

yaml

sylius_grid:
    grids:
        foo:
            fields:
                bar:
                    options:
                        baz: "expr:service('sylius.repository.product').find($id)"

In this case, $id can be prepared in a way that calls other services.

If you visit /route?id="~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~", it will result in a following expression expr:service('repository').find(""~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~""), which will execute a query on the currently connected database.

To find a vulnerability in your application, look for any routing definition that uses request parameters inside expression language.

Patches

This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

Workarounds

The fix requires adding addslashes in OptionsParser::parseOptionExpression to sanitize user input before evaluating it using the expression language.

php

- return is_string($variable) ? sprintf('"%s"', $variable) : $variable;
+ return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;

Acknowledgements

This security issue has been reported by Craig Blanchette (@isometriks), thanks a lot!

For more information

If you have any questions or comments about this advisory:

Email us at security@sylius.com

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Paquete de Composer	sylius/resource-bundle	>= 1.4.0, < 1.4.7, >= 1.5.0, < 1.5.2, >= 1.6.0, < 1.6.4, >= 1.0.0, < 1.3.14	1.4.7, 1.5.2, 1.6.4, 1.3.14

Referencias

Puntuación CVSS 9.6/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Debilidad (CWE): CWE-74, CWE-917
Plataforma: Composer
Paquete: sylius/resource-bundle
Publicada: 19.08.2020
Actualizado: 11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-h6m7-j4h3-9rf5 - CC BY 4.0

Historial de vulnerabilidades: sylius/resource-bundle

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Entradas en total: 4
Primera → última: 01.2020 05.2024
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Crítica 1
Alta 1
Media 1
Baja 1

Divulgaciones por año

2020: 3
2021: 0
2022: 0
2023: 0
2024: 1
2025: 0
2026: 0

29.05.2024

Sylius Resource Bundle Cross-Site Request Forgery vulnerability

Media · 6.5 ghsa-65v7-wg35-2qpm >= 1.0.0, < 1.0.17, >= 1.1.0, < 1.1.9, >= 1.2.0, < 1.2.2 1.0.17, 1.1.9, 1.2.2
19.08.2020

Remote Code Execution in SyliusResourceBundle

Alta · 7.7 CVE-2020-15143 >= 1.4.0, < 1.4.7, >= 1.5.0, < 1.5.2, >= 1.6.0, < 1.6.4, >= 1.0.0, < 1.3.14 1.4.7, 1.5.2, 1.6.4, 1.3.14
19.08.2020

Remote Code Execution in SyliusResourceBundle esta entrada

Crítica · 9.6 CVE-2020-15146 >= 1.4.0, < 1.4.7, >= 1.5.0, < 1.5.2, >= 1.6.0, < 1.6.4, >= 1.0.0, < 1.3.14 1.4.7, 1.5.2, 1.6.4, 1.3.14
31.01.2020

Ability to switch channels via GET parameter enabled in production environments

Baja · 4.4 CVE-2020-5218 >= 1.4.0, < 1.4.6, >= 1.5.0, < 1.5.1, >= 1.6.0, < 1.6.3, >= 1.0.0, < 1.3.13 1.4.6, 1.5.1, 1.6.3, 1.3.13

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación