CVE-2020-15146
📋 TL;DR
This vulnerability allows remote code execution in SyliusResourceBundle by exploiting improper sanitization of request parameters in Symfony expression language. Attackers can access any public service and execute arbitrary code. All systems running affected versions of SyliusResourceBundle are vulnerable.
💻 Affected Systems
- SyliusResourceBundle
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, access sensitive data, and maintain persistent access.
Likely Case
Remote code execution leading to data theft, system manipulation, or deployment of malware.
If Mitigated
Limited impact with proper input validation and service isolation, potentially only information disclosure.
🎯 Exploit Status
Exploitation is straightforward via crafted HTTP requests. Public proof-of-concept exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.14, 1.4.7, 1.5.2, or 1.6.4
Vendor Advisory: https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-h6m7-j4h3-9rf5
Restart Required: Yes
Instructions:
1. Update SyliusResourceBundle to patched version via composer: composer update sylius/resource-bundle. 2. Clear cache: php bin/console cache:clear. 3. Restart web server.
🔧 Temporary Workarounds
Input validation filter
allImplement custom request parameter sanitization to filter expression language inputs.
Implement custom request parameter validation in controller actions
WAF rule
allDeploy web application firewall rules to block requests containing expression language syntax.
Configure WAF to block patterns like '@service' or expression language operators
🧯 If You Can't Patch
- Isolate affected systems from internet access and restrict internal network access.
- Implement strict input validation and sanitization for all request parameters.
🔍 How to Verify
Check if Vulnerable:
Check composer.json for sylius/resource-bundle version. If version is below 1.3.14, 1.4.7, 1.5.2, or 1.6.4, system is vulnerable.Check Version:
composer show sylius/resource-bundle | grep versionsVerify Fix Applied:
Verify composer.lock shows updated version and test that expression language injection no longer works.📡 Detection & Monitoring
Log Indicators:
- Unusual expression language patterns in request parameters
- Unexpected service calls in application logs
- Errors from expression language evaluation
Network Indicators:
- HTTP requests containing '@service' patterns or expression operators
- Unusual outbound connections from web server
SIEM Query:
web_access_logs WHERE uri_query CONTAINS '@' OR uri_query CONTAINS 'service('