TI-2024-38654 Aliases GHSA-p9fg-j6ww-953m

FOSRestBundle issue with broken validation of JSONP callbacks

LOW 38Published 2024-05-15 · Updated 2024-05-15

Key facts

Attack vector: —
Privileges required: —
User interaction: —
Attack complexity: —
Impact type: —
Confidentiality · integrity · availability: —
Fix status: Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

Starting with FOSRestBundle 1.2 we [switched](https://github.com/FriendsOfSymfony/FOSRestBundle/pull/642/files#diff-431bc57ca9ca16332c0cff43ad45263cR37) to using [willdurand/jsonp-callback-validator](https://github.com/willdurand/JsonpCallbackValidator) for validation of JSONP callbacks. However [the change was implemented](https://github.com/FriendsOfSymfony/FOSRestBundle/pull/665) incorrectly validating the callback query param name, rather than its value. Anyone using the JSONP handler (which is off by default) together with FOSRestBundle 1.2.0 or 1.2.1 should update to FOSRestBundle [1.2.2](https://github.com/FriendsOfSymfony/FOSRestBundle/releases/tag/1.2.2).

Why it matters now

Fix Fixed friendsofsymfony/rest-bundle (Packagist): 1.2.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	friendsofsymfony/rest-bundle (Packagist)	1.2.0 to before 1.2.2	1.2.2	Patch available	GHSA-p9fg-j6ww-953m

friendsofsymfony/rest-bundle (Packagist) Vendor— Affected 1.2.0 to before 1.2.2 Fixed in 1.2.2 Patch available GHSA-p9fg-j6ww-953m

Remediation

Fix · GHSA-p9fg-j6ww-953m friendsofsymfony/rest-bundle (Packagist) Fixed in 1.2.2 Advisory →

Timeline

2026-10-03 Threatist record created from GHSA-p9fg-j6ww-953m

References

Other 4

Sources

GHSA-p9fg-j6ww-953m · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences