GitHub Advisoryadvisory · Packagist
GHSA-p9fg-j6ww-953m FOSRestBundle issue with broken validation of JSONP callbacks
MEDIUM
Official page ↗
- Ecosystem
- Packagist
- Packages
- friendsofsymfony/rest-bundle
- Severity
- Moderate
- Reviewed
- 2024-05-15
Affected packages
• Packagist friendsofsymfony/rest-bundle: >= 1.2.0, < 1.2.2 → fixed in 1.2.2
Description
Starting with FOSRestBundle 1.2 we switched to using willdurand/jsonp-callback-validator for validation of JSONP callbacks. However the change was implemented incorrectly validating the callback query param name, rather than its value. Anyone using the JSONP handler (which is off by default) together with FOSRestBundle 1.2.0 or 1.2.1 should update to FOSRestBundle 1.2.2.
References
- https://github.com/FriendsOfSymfony/FOSRestBundle/commit/3dd7d40068360c23366fb4884c5d194c769ec2c1 web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/rest-bundle/2014-01-22-1.yaml web
- https://github.com/FriendsOfSymfony/FOSRestBundle package
- https://symfony.com/blog/fosrestbundle-security-issue-with-jsonp-handler web