Remote Code Execution in SyliusResourceBundle

Vulnerability

Overview

CVE-2020-15143 is a remote code execution (RCE) vulnerability in the SyliusResourceBundle, a Symfony bundle used for CRUD operations. The flaw resides in the ParametersParser::parseRequestValueExpression method, which evaluates request parameters inside expressions using the symfony/expression-language package. User-supplied input is not sanitized before being injected into the expression, enabling an attacker to manipulate the expression to call arbitrary public services [1][4].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious request parameter that contains a string like "~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~". When this parameter is used in a route definition that passes it to an expression (e.g., expr:service('repository').find($id)), the expression language evaluates the injected code, allowing the attacker to invoke any Symfony service [4]. The attack requires no authentication and can be triggered via any route that uses request parameters inside the expression language, as demonstrated in the advisory [4].

Impact

Successful exploitation grants the attacker the ability to execute arbitrary code on the server, including database queries, file system operations, or other actions accessible through public Symfony services. This can lead to full compromise of the application and its data [1][4].

Mitigation

The vulnerability has been patched in versions 1.3.14, 1.4.7, 1.5.2, and 1.6.4 of the SyliusResourceBundle. The fix adds addslashes() to sanitize string variables before they are evaluated in the expression language [4]. Users of affected versions should upgrade immediately. Versions prior to 1.3 were not patched and remain vulnerable [1].