CVE-2024-50345

What it actually does

The Request class parses URIs containing special characters differently than browsers, allowing crafted inputs to bypass domain validation and trigger redirects to arbitrary external domains.

Why it matters to the business

Attackers can phish users or hijack sessions by sending them to malicious sites that appear to come from a trusted application, eroding user trust and increasing support costs.

How an attack unfolds

An attacker crafts a URI with special characters that a browser normalizes to an external domain; the application validator using the Request class accepts it as internal and issues a redirect, sending the victim to the attacker-controlled site.

How to fix it

Upgrade symfony/security-http to the version containing commit cc13b601fc844036fd6c8e7307845da145d5998b or later; retest all redirect logic after the update.

How to confirm the fix worked

Confirm the installed package version includes commit cc13b601fc844036fd6c8e7307845da145d5998b; test redirect endpoints with URIs containing percent-encoded special characters to verify correct domain enforcement.

Typical attack path

1. Identify an endpoint that performs redirects based on Request-derived values
2. Craft a URI containing special characters that browsers resolve differently
3. Deliver the link via email, chat, or another channel
4. Victim follows link; browser and validator disagree on target domain
5. Application issues redirect to attacker domain

How to detect it

Search web server and application logs for redirect responses containing domains outside the expected allow-list; correlate with unusual URI patterns containing percent-encoded characters.

What your security team should do

• Immediately upgrade symfony/security-http to the fixed commit
• Review all redirect and URL validation code for similar parsing assumptions
• Add automated tests that compare browser and server URI normalization
• Monitor application logs for unexpected external redirect targets