Symfony FOSJsRoutingBundle

What is the Symfony FOSJsRoutingBundle?

The Symfony FOSJsRoutingBundle is a module that detects misconfigurations in the Symfony framework. It targets the FOSJsRoutingBundle, which is a Symfony bundle that provides JavaScript routing capabilities.

This module has a medium severity level, indicating that it can potentially lead to security vulnerabilities if not properly configured.

Author: DhiyaneshDk

Impact

If misconfigured, the Symfony FOSJsRoutingBundle can expose sensitive information and potentially allow unauthorized access to routes and resources within the Symfony application.

How the module works?

The module works by sending an HTTP GET request to the "/js/routing?callback=fos.Router.setDatafoobarfoo" endpoint. It then applies several matching conditions to determine if a misconfiguration is present.

The matching conditions include:

- The response body must contain the following words: /**/fos.Router.setDatafoobarfoo({ and routes - The response header must include the word application/javascript - The HTTP status code must be 200

If all the matching conditions are met, the module will report a misconfiguration in the Symfony FOSJsRoutingBundle.

Reference:

- https://packagist.org/packages/friendsofsymfony/jsrouting-bundle

Metadata:

max-request: 1

verified: true

shodan-query: http.html:"symfony Profiler"