Remote Code Execution in SyliusResourceBundle

Vulnerability

CVE-2020-15146 is a remote code execution vulnerability in the SyliusResourceBundle, a Symfony bundle providing CRUD operations for Sylius e-commerce applications. The root cause is unsanitized request parameters injected into expressions evaluated by the symfony/expression-language package. The OptionsParser::parseOptionExpression method directly interpolates string request parameters into expression strings without escaping special characters, allowing an attacker to break out of the intended expression context [1][4].

Exploitation

An attacker can exploit this by crafting a malicious request parameter that, when embedded in a grid or resource configuration expression, injects arbitrary ExpressionLanguage syntax. For example, a parameter like "~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~" can be injected from a URL query string. The attacker needs only network access to an endpoint that uses the vulnerable grid options parsing; no authentication is mentioned as a prerequisite, making this exploitable by unauthenticated users if such endpoints are exposed [4]. The expression language allows calling any public service, so the attacker can chain service calls to achieve arbitrary code execution.

Impact

Successful exploitation grants the attacker the ability to invoke any public service in the Symfony container. This can be used to read sensitive data, modify database contents, or execute arbitrary code on the server, leading to full application compromise [1][4]. The example provided in the advisory demonstrates deleting all rows from a table, indicating severe data integrity and availability impacts.

Mitigation

The vulnerability is patched in versions 1.3.14, 1.4.7, 1.5.2, and 1.6.4. The fix adds addslashes() around string variables in OptionsParser::parseOptionExpression to sanitize user input before evaluation [4]. Versions prior to 1.3 were not patched and remain vulnerable; users of those versions should upgrade to a supported release. No workaround beyond the patch is documented, but administrators should ensure no untrusted users can supply request parameters to affected grid definitions.