symfony-fragment: Symfony _fragment - Detect

id: symfony-fragment

info:
  name: Symfony _fragment - Detect
  author: Palanichamy_perumal,TechbrunchFR
  severity: unknown
  description: |
    Symfony servers support a "/_fragment" command that allows clients to provide custom PHP commands and return the HTML output.
  reference:
    - https://portswigger.net/daily-swig/symfony-based-websites-open-to-rce-attack-research-finds
    - https://medium.com/@m4cddr/how-i-got-rce-in-10-websites-26dd87441f22
    - https://al1z4deh.medium.com/how-i-hacked-28-sites-at-once-rce-5458211048d5
    - https://github.com/ambionics/symfony-exploits
  classification:
    cpe: cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
    cwe-id: CWE-15,CWE-94
  metadata:
    verified: true
    max-request: 1
    vendor: sensiolabs
    product: symfony
    shodan-query: http.html:"symfony Profiler"
  tags: config,exposure,symfony,misconfig,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/_fragment'

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 403"
          - "contains(body, 'Symfony') || contains(body, '403 Forbidden')"
          - "(\"8b2f83102bc96e5068d36df80301a64d\" == md5(body)) || (\"4df206fbc337c398c3b669172934c8cb\" == md5(body))"
        condition: and
# digest: 4b0a00483046022100c3a6f08252f0bc0753a3612af06e6cbc6cd3304ef59973b6c3528faf92bee49c022100c431ceddca474b2e98d6c4ab78161adbb2217fab0691bfa131e9d6971f421bf0:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.