Symfony 2.7.0 to 2.7.48, 2.8.0 to 2.8.43, 3.3.0 to 3.3.17, 3.4.0 to 3.4.13, 4.0.0 to 4.0.13
and 4.1.0 to 4.1.2 versions of the Symfony HttpFoundation component are affected by this
The issue has been fixed in Symfony 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, and 4.1.3.
Note that no fixes are provided for Symfony 3.0, 3.1, and 3.2 as they are not
Support for a (legacy) IIS header that lets users override the path in the request URL via the
X-Rewrite-URL HTTP request header allows a user to access one URL but have Symfony return a different one which can bypass restrictions on higher level caches and web servers.
The fix drops support for these two obsolete IIS headers:
Support for the offending headers has been removed.
The patch for this issue is available here for branch 2.8.
I would like to thank Michael Cullum for reporting the issue and Nicolas Grekas for fixing it.
[risorsa: Symfony Blog https://ift.tt/2O4AreL ]