VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 30, 2020· Updated Aug 4, 2024

Exceptions displayed in non-debug configurations in Symfony

CVE-2020-5274

Description

In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the ErrorHandler rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
symfony/error-handlerPackagist
>= 4.4.0, < 4.4.44.4.4
symfony/error-handlerPackagist
>= 5.0.0, < 5.0.45.0.4
symfony/symfonyPackagist
>= 4.4.0, < 4.4.44.4.4
symfony/symfonyPackagist
>= 5.0.0, < 5.0.45.0.4

Affected products

1

Patches

2
629d21b800a1

Escape variable in Exception Template

https://github.com/symfony/symfonyJérémy DerusséFeb 4, 2020via ghsa
commit
1 file changed · +3 −3
  • src/Symfony/Component/ErrorHandler/Resources/views/traces_text.html.php+3 −3 modified
    @@ -20,15 +20,15 @@
                 <?php if ($exception['trace']) { ?>
                 <pre class="stacktrace">
 <?php
-                    echo $exception['class'].":\n";
+                    echo $this->escape($exception['class']).":\n";
                     if ($exception['message']) {
-                        echo $exception['message']."\n";
+                        echo $this->escape($exception['message'])."\n";
                     }
 
                     foreach ($exception['trace'] as $trace) {
                         echo "\n  ";
                         if ($trace['function']) {
-                            echo 'at '.$trace['class'].$trace['type'].$trace['function'].'('.(isset($trace['args']) ? $this->formatArgsAsText($trace['args']) : '').')';
+                            echo $this->escape('at '.$trace['class'].$trace['type'].$trace['function']).'('.(isset($trace['args']) ? $this->formatArgsAsText($trace['args']) : '').')';
                         }
                         if ($trace['file'] && $trace['line']) {
                             echo($trace['function'] ? "\n     (" : 'at ').strtr(strip_tags($this->formatFile($trace['file'], $trace['line'])), [' at line '.$trace['line'] => '']).':'.$trace['line'].($trace['function'] ? ')' : '');
cf80224589ac

Added debug argument to decide if debug page should be shown or not

https://github.com/symfony/symfonyYonel CerutoJan 24, 2020via ghsa
commit
2 files changed · +5 −3
  • src/Symfony/Component/ErrorHandler/Debug.php+1 −1 modified
    @@ -31,6 +31,6 @@ public static function enable(): ErrorHandler
 
         DebugClassLoader::enable();
 
-        return ErrorHandler::register(new ErrorHandler(new BufferingLogger()));
+        return ErrorHandler::register(new ErrorHandler(new BufferingLogger(), true));
     }
 }
  • src/Symfony/Component/ErrorHandler/ErrorHandler.php+4 −2 modified
    @@ -92,6 +92,7 @@ class ErrorHandler
     private $screamedErrors = 0x55; // E_ERROR + E_CORE_ERROR + E_COMPILE_ERROR + E_PARSE
     private $loggedErrors = 0;
     private $traceReflector;
+    private $debug;
 
     private $isRecursive = 0;
     private $isRoot = false;
@@ -180,14 +181,15 @@ public static function call(callable $function, ...$arguments)
         }
     }
 
-    public function __construct(BufferingLogger $bootstrappingLogger = null)
+    public function __construct(BufferingLogger $bootstrappingLogger = null, bool $debug = false)
     {
         if ($bootstrappingLogger) {
             $this->bootstrappingLogger = $bootstrappingLogger;
             $this->setDefaultLogger($bootstrappingLogger);
         }
         $this->traceReflector = new \ReflectionProperty('Exception', 'trace');
         $this->traceReflector->setAccessible(true);
+        $this->debug = $debug;
     }
 
     /**
@@ -697,7 +699,7 @@ public static function handleFatalError(array $error = null): void
      */
     private function renderException(\Throwable $exception): void
     {
-        $renderer = \in_array(\PHP_SAPI, ['cli', 'phpdbg'], true) ? new CliErrorRenderer() : new HtmlErrorRenderer(0 !== $this->scopedErrors);
+        $renderer = \in_array(\PHP_SAPI, ['cli', 'phpdbg'], true) ? new CliErrorRenderer() : new HtmlErrorRenderer($this->debug);
 
         $exception = $renderer->render($exception);

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.