AjaxController

[unknown-opensource]

So you're just giving public access for anyone to lookup any table by any field?
why not just pass DQL as parameter?

[66Ton99]

Its return true or false only!

[unknown-opensource]

You can learn a lot by performing simple if (i.e. are John and Tom friends, was John born in 1981, is there any cash in Toms account)

[paolo42]

It is a pretty serious issue I think. For example - attacker can retrieve user passwords using repository method findByPassword. The method doesn't have to exist, Doctrine allows to use these magic methods if there is a DB column with the given name. By trying all password hashes you can eventually find password hash stored in DB. Not to mention projects with passwords in plaintext etc. True/false is enough for this, we don't want to simplify it to attackers.

You can also pass arrays to POST, which means that the attacker can use AND WHERE clause in these requests.

I believe it is also possible to use deleteBy* methods etc. These are not implemented by default but this issue allows attacker also to use custom repository - and a custom repository could have methods like this implemented.

I found out about this issue because some robot was trying to access this URL on my project without it being used in my code at all. This could mean that someone already wrote a robot to scan Symfony projects and check whether this route is accessible.