VYPR
← All advisories
Medium severityGHSA Advisory· Published May 30, 2024· Updated May 30, 2024

Symfony has a security issue when parsing the Authorization header

CVE-2014-6061

Description

All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony HttpFoundation component are affected by this security issue.

This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore.

Description

When an application uses an HTTP basic or digest authentication, Symfony does not parse the Authorization header properly, which could be exploited in some server setups (no exploits have been demonstrated though.)

Resolution

The parsing of the Authorization header has been fixed to comply to the HTTP specification.

The patch for this issue is available here: https://github.com/symfony/symfony/pull/11829

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
symfony/http-foundationPackagist
>= 2.0.0, < 2.3.192.3.19
symfony/http-foundationPackagist
>= 2.4.0, < 2.4.92.4.9
symfony/http-foundationPackagist
>= 2.5.0, < 2.5.42.5.4
symfony/symfonyPackagist
>= 2.0.0, < 2.3.192.3.19
symfony/symfonyPackagist
>= 2.4.0, < 2.4.92.4.9
symfony/symfonyPackagist
>= 2.5.0, < 2.5.42.5.4

Affected products

1

Patches

1
3b4046e89467

[HttpFoundation] added some missing tests

https://github.com/symfony/symfonyFabien PotencierSep 1, 2014via ghsa
commit
1 file changed · +12 −10
  • src/Symfony/Component/HttpFoundation/Tests/ServerBagTest.php+12 −10 modified
    @@ -71,19 +71,20 @@ public function testHttpBasicAuthWithPhpCgiBogus()
     {
         $bag = new ServerBag(array('HTTP_AUTHORIZATION' => 'Basic_'.base64_encode('foo:bar')));
 
-        $this->assertEquals(array(
-            'AUTHORIZATION' => 'Basic_'.base64_encode('foo:bar'),
-        ), $bag->getHeaders());
+        // Username and passwords should not be set as the header is bogus
+        $headers = $bag->getHeaders();
+        $this->assertFalse(isset($headers['PHP_AUTH_USER']));
+        $this->assertFalse(isset($headers['PHP_AUTH_PW']));
     }
 
     public function testHttpBasicAuthWithPhpCgiRedirect()
     {
-        $bag = new ServerBag(array('REDIRECT_HTTP_AUTHORIZATION' => 'Basic '.base64_encode('foo:bar')));
+        $bag = new ServerBag(array('REDIRECT_HTTP_AUTHORIZATION' => 'Basic '.base64_encode('username:pass:word')));
 
         $this->assertEquals(array(
-            'AUTHORIZATION' => 'Basic '.base64_encode('foo:bar'),
-            'PHP_AUTH_USER' => 'foo',
-            'PHP_AUTH_PW' => 'bar'
+            'AUTHORIZATION' => 'Basic '.base64_encode('username:pass:word'),
+            'PHP_AUTH_USER' => 'username',
+            'PHP_AUTH_PW' => 'pass:word'
         ), $bag->getHeaders());
     }
 
@@ -114,9 +115,10 @@ public function testHttpDigestAuthWithPhpCgiBogus()
         $digest = 'Digest_username="foo", realm="acme", nonce="'.md5('secret').'", uri="/protected, qop="auth"';
         $bag = new ServerBag(array('HTTP_AUTHORIZATION' => $digest));
 
-        $this->assertEquals(array(
-            'AUTHORIZATION' => $digest,
-        ), $bag->getHeaders());
+        // Username and passwords should not be set as the header is bogus
+        $headers = $bag->getHeaders();
+        $this->assertFalse(isset($headers['PHP_AUTH_USER']));
+        $this->assertFalse(isset($headers['PHP_AUTH_PW']));
     }
 
     public function testHttpDigestAuthWithPhpCgiRedirect()

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.