CVE-2020-5274: Generation of Error Message Containing Sensitive Information (CWE-209)
value: In Symfony before versions 5.0.5 and 4.4.5, some properties of the Exception were not properly escaped when the `ErrorHandler` rendered it stacktrace. In addition, the stacktrace were displayed even in a non-debug configuration. The ErrorHandler now escape alls properties of the exception, and the stacktrace is only display in debug configuration. This issue is patched in symfony/http-foundation versions 4.4.5 and 5.0.5
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 5.4
Published: 2020-03-30T20:15Z
Repository: https://github.com/symfony/symfony
Language: PHP
Files changed: src/Symfony/Component/ErrorHandler/Resources/views/traces_text.html.php
Commit date: 2020-02-04 10:53:50 +0100
Commit message: Escape variable in Exception Template

Diff: diff --git a/src/Symfony/Component/ErrorHandler/Resources/views/traces_text.html.php b/src/Symfony/Component/ErrorHandler/Resources/views/traces_text.html.php
index e178fe0fcd4..a7090fbe890 100644
--- a/src/Symfony/Component/ErrorHandler/Resources/views/traces_text.html.php
+++ b/src/Symfony/Component/ErrorHandler/Resources/views/traces_text.html.php
@@ -18,19 +18,19 @@
         <tr>
             <td>
                 <?php if ($exception['trace']) { ?>
                 <pre class="stacktrace">
 <?php
-                    echo $exception['class'].":\n";
+                    echo $this->escape($exception['class']).":\n";
                     if ($exception['message']) {
-                        echo $exception['message']."\n";
+                        echo $this->escape($exception['message'])."\n";
                     }
 
                     foreach ($exception['trace'] as $trace) {
                         echo "\n  ";
                         if ($trace['function']) {
-                            echo 'at '.$trace['class'].$trace['type'].$trace['function'].'('.(isset($trace['args']) ? $this->formatArgsAsText($trace['args']) : '').')';
+                            echo $this->escape('at '.$trace['class'].$trace['type'].$trace['function']).'('.(isset($trace['args']) ? $this->formatArgsAsText($trace['args']) : '').')';
                         }
                         if ($trace['file'] && $trace['line']) {
                             echo($trace['function'] ? "\n     (" : 'at ').strtr(strip_tags($this->formatFile($trace['file'], $trace['line'])), [' at line '.$trace['line'] => '']).':'.$trace['line'].($trace['function'] ? ')' : '');
                         }
                     }

Vulnerable code:                     echo $exception['class'].":\n";
                        echo $exception['message']."\n";
                            echo 'at '.$trace['class'].$trace['type'].$trace['function'].'('.(isset($trace['args']) ? $this->formatArgsAsText($trace['args']) : '').')';
Fixed code:                     echo $this->escape($exception['class']).":\n";
                        echo $this->escape($exception['message'])."\n";
                            echo $this->escape('at '.$trace['class'].$trace['type'].$trace['function']).'('.(isset($trace['args']) ? $this->formatArgsAsText($trace['args']) : '').')';