Symfony: HtmlSanitizer Does Not URL-Sanitize srcset and imagesrcset: Media Scheme and Host Allow-List Bypass

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

The Symfony HtmlSanitizer component does not apply the media URL policy to the srcset and imagesrcset attributes, allowing values that point to hosts or schemes not permitted by allowMediaSchemes() or allowMediaHosts() to bypass it, so that browsers load images from disallowed hosts in Symfony versions 6.1.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11.The srcset attribute on img and source elements and the imagesrcset attribute on link elements are allowed by the sanitizer, but their URL candidates are never validated, so their values are kept verbatim while the same URL in src is dropped. The fixes for CVE-2026-45753 and CVE-2026-48761 extended the same attribute list but did not cover these two attributes. For example, with allowMediaSchemes(['https']) and allowMediaHosts(['trusted.example']), <img srcset="https://evil.example/a.png 1x"> survives sanitization, and the browser fetches the selected candidate as it would fetch src. Candidates with a scheme forbidden by the configuration, such as http, are kept as well.
Any application that sanitizes untrusted HTML and relies on the media schemes and hosts allowlists to restrict where images can be loaded from is affected. A single crafted value is enough to make the browser of a user viewing the sanitized content send a request to an attacker-controlled host, which can be used to track viewers or log their IP addresses. No authentication is needed if the application accepts HTML from unauthenticated users.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…ommit/50e7a38a8f088601c09669b9d267c9c0228884e1 Yama
• github.com/…ymfony/security/advisories/GHSA-q8jq-xrf4-v5j8 Üçüncü taraf

Kayıt geçmişi

1. 5 Kas 2026 20:46Yayımlandı

İlgili açıklar

• 2,3 CVE-2026-118517Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URLs Without a Well-Formed Authority (Incomplete Fix for CVE-2026-45066)
• 6,3 CVE-2026-123125Symfony: Ip Constraint public/private Modes Accept IPv4-Mapped and IPv4-Compatible IPv6 Addresses allowing SSRF Filter Bypass
• 2,3 CVE-2026-123119Symfony: NoPrivateNetworkHttpClient Does Not Pin the Checked IP of Cached Hosts, Letting DNS Rebinding Enumerate Inte…
• 8,2 CVE-2026-121971Symfony HttpClient: ScopingHttpClient kimlik bilgilerini farklı kaynaklara gönderebiliyor
• 5,3 CVE-2026-121373Symfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)
• 6,3 CVE-2026-118516Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control