symfony-lock-exposure: Symfony Lock File - Exposure

id: symfony-lock-exposure

info:
  name: Symfony Lock File - Exposure
  author: ritikchaddha
  severity: low
  description: |
    symfony.lock was found accessible, exposing a full list of installed Composer packages, library versions, and metadata for a Symfony-based PHP application. Disclosure of this file can provide insight into the application's attack surface, potentially revealing vulnerable or outdated dependencies and aiding an attacker in choosing their exploit strategy.
  impact: |
    Attackers can enumerate all installed Composer packages and versions, increasing the risk of targeted attacks (e.g., against known CVEs in dependencies) or application fingerprinting.
  remediation: |
    Restrict direct access to internal and sensitive files such as symfony.lock via proper web server configuration (e.g., .htaccess, nginx directives) and consider excluding such files from the web root in deployment.
  reference:
    - https://cheatsheetseries.owasp.org/cheatsheets/Information_Leakage.html
    - https://symfony.com/doc/current/deployment.html
  metadata:
    verified: true
    max-request: 1
    vendor: symfony
    product: symfony
    shodan-query: http.component:"symfony"
    fofa-query: body="symfony.lock"
  tags: symfony,exposure,composer,php,config,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/symfony.lock"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "version\":", ": {", "branch\":")'
          - 'contains_any(body, "symfony/", "php\":")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100e9d24ddcf142e55e85a6b172ad62bc6cf23efcb4afdd0c37bf77addee5741593022100fe6b0256c3dd87d04720bd40dcba44cdf109ac35cb97763d46fa25699eec0a11:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.