Description
web应用程序使用Symfony框架。Symfony调试模式启用。调试模式应该在生产环境中关闭，因为它会导致有关web应用程序的敏感信息泄露。
Symfony framework debug 存在任意文件读取漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/emadshanab/goby-poc/blob/main/Symfony-framework-debug-Local-File-Inclusion.json
https://medium.com/@p.ra.dee.p_0xx01/bug-multiple-vulnerabilities-in-symfony-profiler-debug-mode-a81c385c9728
https://blog.csdn.net/kk1234/article/details/155045013
https://infosecwriteups.com/how-i-was-able-to-find-multiple-vulnerabilities-of-a-symfony-web-framework-web-application-2b82cd5de144
https://www.vaadata.com/en/blog/symfony-security-best-practices-vulnerabilities-and-attacks/
https://www.leavesongs.com/PENETRATION/edusoho-debug-user-information-disclose.html
https://pentest-tools.com/vulnerabilities-exploits/symfony-profiler-remote-access-via-injected-arguments_23822
https://www.acunetix.com/vulnerabilities/web/symfony-debug-mode-enabled/
https://blog.lexfo.fr/symfony-secret-fragment.html
https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7
https://www.invicti.com/web-application-vulnerabilities/symfony-web-debug-toolbar