Affected versions
Symfony HTTP Client versions <5.4.56, >=6, <6.4.50, >=7, <7.4.23, >=8, <8.1.11 are affected by this security issue.
The issue has been fixed in Symfony HTTP Client 5.4.56, 6.4.50, 7.4.23, 8.1.11.
Description
NoPrivateNetworkHttpClient resolves the host of each request and checks the IP before connecting. To make the decorated client connect to that same IP, it passes the IP with the resolve option. It also caches the IP of each host. But it passed the IP with resolve only when it resolved a host for the first time. On the next requests to the same host, the decorated client resolved the host again by itself.
An attacker who controls the DNS of a host can use DNS rebinding. The first lookup then returns a public IP and the next ones a private IP. When an application sends several requests to that host through the same client, the later requests connect to the private IP. This happens for example when an application fetches several URLs of a repository provided by a user. The check of the primary_ip in the on_progress callback still aborts the request before anything is sent. But the connection is made, and the error differs depending on whether the port is open or closed. This allows enumerating internal hosts and ports, like CVE-2024-50342.
Resolution
NoPrivateNetworkHttpClient now passes the IP with the resolve option for cached hosts too, so that every request connects to the IP that was checked.
The patch for this issue is available here for branch 5.4 (and forward-ported to 6.4, 7.4, 8.1 and 8.2).
Credits
We would like to thank Eirik Stanghelle Morland from Packagist for reporting the issue and Nicolas Grekas for providing the fix.