CVE-2024-50342

What it actually does

The NoPrivateNetworkHttpClient leaks internal details such as resolved host IPs or ports during DNS/host resolution, allowing enumeration despite the private network restriction.

Why it matters to the business

Attackers may obtain limited visibility into internal network layout, which could support reconnaissance for further attacks, though overall risk remains low due to minimal exploitability.

How an attack unfolds

An attacker sends crafted requests through an application component that uses NoPrivateNetworkHttpClient, triggering resolution attempts against private targets and observing the leaked resolution data to map IPs and ports.

How to fix it

Upgrade symfony/symfony to the commit 296d4b34a33b1a6ca5475c6040b3203622520f5b or later that resolves the leak in NoPrivateNetworkHttpClient.

How to confirm the fix worked

Confirm the patched commit is present in the Symfony codebase and test that host resolution no longer exposes internal IP or port details when using NoPrivateNetworkHttpClient.

Typical attack path

1. Locate an application endpoint that invokes NoPrivateNetworkHttpClient
2. Issue requests designed to force resolution of internal or private hostnames
3. Inspect responses, errors, or logs for leaked IP and port information
4. Use enumerated details to refine subsequent reconnaissance or attacks

How to detect it

Examine application and web server logs for host resolution attempts or error messages involving private network addresses; look for patterns of requests that could trigger the client against internal targets.

What your security team should do

• Apply the fixed commit 296d4b34a33b1a6ca5475c6040b3203622520f5b immediately in all Symfony environments
• Audit all usages of NoPrivateNetworkHttpClient for proper private-network enforcement
• Review application logs for any prior host-resolution activity involving private addresses