Collected research

Secret fragments: Remote code execution on Symfony based websites

When a Symfony app exposes the ESI /_fragment endpoint and its secret key is default, guessable, leaked, or brute-forceable, an attacker can forge the HMAC that signs a /_fragment URL. A signed request can call any function or method, so system() or a Yaml Inline::parse php/object deserialization gadget yields remote code execution.

Record

Published by

blog.lexfo.fr

Topic

Server

In the archive

• Collected in the 2020 research round

Related sources

• Author hashcat implementation
• Research exploit code

Tags

• rce
• deserialization
• gadget-chain
• symfony
• php
• cve
• info-leak
• attack-chain
• owasp-a08-2021

This page is the archive's own catalogue record. The research is the work of blog.lexfo.fr, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 9 August 2026.