High

Remote Code Execution in SyliusResourceBundle

Disclosed: 19.08.2020
Updated: 11.10.2026 10:22

Impact

Request parameters injected inside an expression evaluated by symfony/expression-language package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution.

The vulnerable versions include: <=1.3.13 || >=1.4.0 <=1.4.6 || >=1.5.0 <=1.5.1 || >=1.6.0 <=1.6.3.

Example

yaml

foo:
    path: /foo/{id}
    defaults:
        _sylius:
            repository:
                method: findSome
                arguments:
                    entity: "expr:service('repository').find($id)"

In this case, $id can be prepared in a way that calls other services.

If you visit /foo/"~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~", it will result in a following expression expr:service('repository').find(""~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~""), which will execute a query on the currently connected database.

To find a vulnerability in your application, look for any routing definition that uses request parameters inside expression language.

Patches

This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

Workarounds

The fix requires adding addslashes in ParametersParser::parseRequestValueExpression to sanitize user input before evaluating it using the expression language.

php

- return is_string($variable) ? sprintf('"%s"', $variable) : $variable;
+ return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;

Acknowledgements

This security issue has been reported by Craig Blanchette (@isometriks), thanks a lot!

For more information

If you have any questions or comments about this advisory:

Email us at security@sylius.com

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Composer package	sylius/resource-bundle	>= 1.4.0, < 1.4.7, >= 1.5.0, < 1.5.2, >= 1.6.0, < 1.6.4, >= 1.0.0, < 1.3.14	1.4.7, 1.5.2, 1.6.4, 1.3.14

References

CVSS score 7.7/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Weakness (CWE): CWE-74, CWE-917
Platform: Composer
Package: sylius/resource-bundle
Disclosed: 19.08.2020
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-p4pj-9g59-4ppv - CC BY 4.0

Vulnerability history: sylius/resource-bundle

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 4
First → latest: 01.2020 05.2024
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 1
High 1
Medium 1
Low 1

Disclosures per year

2020: 3
2021: 0
2022: 0
2023: 0
2024: 1
2025: 0
2026: 0

29.05.2024

Sylius Resource Bundle Cross-Site Request Forgery vulnerability

Medium · 6.5 ghsa-65v7-wg35-2qpm >= 1.0.0, < 1.0.17, >= 1.1.0, < 1.1.9, >= 1.2.0, < 1.2.2 1.0.17, 1.1.9, 1.2.2
19.08.2020

Remote Code Execution in SyliusResourceBundle this entry

High · 7.7 CVE-2020-15143 >= 1.4.0, < 1.4.7, >= 1.5.0, < 1.5.2, >= 1.6.0, < 1.6.4, >= 1.0.0, < 1.3.14 1.4.7, 1.5.2, 1.6.4, 1.3.14
19.08.2020

Remote Code Execution in SyliusResourceBundle

Critical · 9.6 CVE-2020-15146 >= 1.4.0, < 1.4.7, >= 1.5.0, < 1.5.2, >= 1.6.0, < 1.6.4, >= 1.0.0, < 1.3.14 1.4.7, 1.5.2, 1.6.4, 1.3.14
31.01.2020

Ability to switch channels via GET parameter enabled in production environments

Low · 4.4 CVE-2020-5218 >= 1.4.0, < 1.4.6, >= 1.5.0, < 1.5.1, >= 1.6.0, < 1.6.3, >= 1.0.0, < 1.3.13 1.4.6, 1.5.1, 1.6.3, 1.3.13

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application