{"id":"GHSA-p4pj-9g59-4ppv","summary":"Remote Code Execution in SyliusResourceBundle","details":"### Impact\n\nRequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution.\n\nThe vulnerable versions include: `\u003c=1.3.13 || \u003e=1.4.0 \u003c=1.4.6 || \u003e=1.5.0 \u003c=1.5.1 || \u003e=1.6.0 \u003c=1.6.3`.\n\n### Example\n\n```yaml\nfoo:\n    path: /foo/{id}\n    defaults:\n        _sylius:\n            repository:\n                method: findSome\n                arguments:\n                    entity: \"expr:service('repository').find($id)\"\n```\n\nIn this case, `$id` can be prepared in a way that calls other services. \n\nIf you visit `/foo/\"~service('doctrine').getManager().getConnection().executeQuery(\"DELETE * FROM TABLE\")~\"`, it will result in a following expression `expr:service('repository').find(\"\"~service('doctrine').getManager().getConnection().executeQuery(\"DELETE * FROM TABLE\")~\"\")`, which will execute a query on the currently connected database.\n\nTo find a vulnerability in your application, look for any routing definition that uses request parameters inside expression language.\n\n### Patches\n\nThis issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.\n\n### Workarounds\n\nThe fix requires adding `addslashes` in `ParametersParser::parseRequestValueExpression` to sanitize user input before evaluating it using the expression language.\n\n```php\n- return is_string($variable) ? sprintf('\"%s\"', $variable) : $variable;\n+ return is_string($variable) ? sprintf('\"%s\"', addslashes($variable)) : $variable;\n```\n\n### Acknowledgements\n\nThis security issue has been reported by Craig Blanchette (@isometriks), thanks a lot!\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Email us at [security@sylius.com](mailto:security@sylius.com)","aliases":["CVE-2020-15143"],"modified":"2026-07-08T06:00:09.533343110Z","published":"2020-08-19T21:04:25Z","database_specific":{"cwe_ids":["CWE-74","CWE-917"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2020-08-19T20:30:42Z","nvd_published_at":"2020-08-20T01:17:00Z"},"references":[{"type":"WEB","url":"https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-p4pj-9g59-4ppv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15143"},{"type":"WEB","url":"https://github.com/Sylius/SyliusResourceBundle/commit/73ed8b8bb083f36c30ad7c3cec336f65d6a80650"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-15143.yaml"},{"type":"PACKAGE","url":"https://github.com/Sylius/SyliusResourceBundle"}],"affected":[{"package":{"name":"sylius/resource-bundle","ecosystem":"Packagist","purl":"pkg:composer/sylius/resource-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.0"},{"fixed":"1.4.7"}]}],"versions":["v1.4.0","v1.4.1","v1.4.2","v1.4.3","v1.4.4","v1.4.5","v1.4.6"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-p4pj-9g59-4ppv/GHSA-p4pj-9g59-4ppv.json"}},{"package":{"name":"sylius/resource-bundle","ecosystem":"Packagist","purl":"pkg:composer/sylius/resource-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.5.0"},{"fixed":"1.5.2"}]}],"versions":["v1.5.0","v1.5.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-p4pj-9g59-4ppv/GHSA-p4pj-9g59-4ppv.json"}},{"package":{"name":"sylius/resource-bundle","ecosystem":"Packagist","purl":"pkg:composer/sylius/resource-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.4"}]}],"versions":["v1.6.0","v1.6.1","v1.6.2","v1.6.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-p4pj-9g59-4ppv/GHSA-p4pj-9g59-4ppv.json"}},{"package":{"name":"sylius/resource-bundle","ecosystem":"Packagist","purl":"pkg:composer/sylius/resource-bundle"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"fixed":"1.3.14"}]}],"versions":["v1.0.0","v1.0.1","v1.0.10","v1.0.11","v1.0.12","v1.0.13","v1.0.14","v1.0.15","v1.0.16","v1.0.17","v1.0.18","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.0.7","v1.0.8","v1.0.9","v1.1.0","v1.1.0-RC","v1.1.1","v1.1.10","v1.1.11","v1.1.12","v1.1.13","v1.1.14","v1.1.15","v1.1.17","v1.1.18","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.1.6","v1.1.7","v1.1.8","v1.1.9","v1.2.0","v1.2.0-BETA","v1.2.0-RC","v1.2.1","v1.2.10","v1.2.11","v1.2.12","v1.2.13","v1.2.14","v1.2.15","v1.2.16","v1.2.17","v1.2.2","v1.2.3","v1.2.4","v1.2.5","v1.2.6","v1.2.7","v1.2.8","v1.2.9","v1.3.0","v1.3.0-BETA","v1.3.1","v1.3.10","v1.3.11","v1.3.12","v1.3.13","v1.3.2","v1.3.3","v1.3.4","v1.3.5","v1.3.6","v1.3.7","v1.3.8","v1.3.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/08/GHSA-p4pj-9g59-4ppv/GHSA-p4pj-9g59-4ppv.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N"}]}