CVE-2014-5245: 
PHP vulnerability analysis and mitigation

CVE-2014-5245 is a security vulnerability affecting Symfony's HttpKernel component, specifically related to direct access of ESI (Edge Side Includes) URLs behind a trusted proxy. The vulnerability was discovered and disclosed on September 3, 2014. It affects multiple versions of Symfony, including versions 2.0.x through 2.5.x (specifically versions 2.0.0 to 2.3.19, 2.4.0 to 2.4.9, and 2.5.0 to 2.5.4) (GitHub Advisory).

The vulnerability exists in the FragmentHandler component where requests to render fragments were considered as coming from a trusted source when using a proxy like Varnish, even if the client was requesting them directly. This created a security issue as Symfony could not distinguish between ESI requests made on behalf of the client by Varnish and faked fragment requests coming directly from the client. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The vulnerability only affects applications that have the ESI feature enabled and are running behind a proxy. When exploited, it could allow attackers to directly access ESI URLs that should only be accessible through the trusted proxy, potentially exposing sensitive information or functionality that should be restricted (GitHub Advisory).

The vulnerability is exploitable when the ESI feature is enabled and there is a proxy configured as trusted in front of the web application. An attacker could potentially forge requests to access fragment URLs directly, bypassing intended access controls (GitHub Advisory).

The issue has been fixed in Symfony versions 2.3.19, 2.4.9, and 2.5.4. For unsupported versions or as a temporary workaround, users can implement a Varnish configuration rule to block direct access to fragment URLs: sub vcl_recv { if (req.restarts == 0 && req.url ~ "^/_fragment") { error 400; } }. The fix involves signing all fragment URIs, even for ESI, rather than relying on trusted IPs for fragment request validation (GitHub Advisory, GitHub Commit).