CVE-2018-14773: Symfony HttpFoundation trusts X-Original-URL and X-Rewrite-URL headers

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityNetwork-reachable path override with High integrity impact and a very high EPSS score, though exploitation is not confirmed in KEV.

What it is

Symfony's HttpFoundation component accepts the legacy IIS headers X-Original-URL and X-Rewrite-URL to override the request path without verifying the server is actually IIS. Any client that can send HTTP requests to an affected application can therefore control the path Symfony believes was requested. The vendor fix removes support for these headers entirely, citing attack vectors such as web cache poisoning.

Impact

An attacker can rewrite the request path seen by the application, enabling web cache poisoning and related path-confusion attacks; the CVSS vector rates integrity impact as High with no confidentiality or availability impact.

Attack surface

Reached over the network by sending a crafted HTTP request containing X-Original-URL or X-Rewrite-URL; the CVSS vector requires low privileges (PR:L) and no user interaction, and the description states anybody who can send these requests can trigger it.

Exploitation

Not listed in CISA KEV and no public exploit or exploitation tags appear in the references, but EPSS is high at roughly 0.58 probability (99th percentile), indicating elevated predicted likelihood of exploitation activity.

What to do

• Upgrade Symfony to a release that drops support for X-Original-URL and X-Rewrite-URL (per the vendor advisory and commit e447e8b); apply the corresponding Debian DSA-4441 and Drupal SA-CORE-2018-005 updates where those products bundle the component.
• Strip or reject X-Original-URL and X-Rewrite-URL headers at the reverse proxy, load balancer or WAF before requests reach the application.
• Ensure caching layers and CDNs do not key or route on these headers, and normalize request paths before caching.
• Audit custom code and middleware for any reliance on these headers and remove it.

Detection

• Search web and proxy logs for requests containing X-Original-URL or X-Rewrite-URL headers, especially with values differing from the actual request path.
• Alert on cache HIT/MISS anomalies or unexpected cached responses tied to requests carrying these headers.
• Monitor for path values in these headers that point to privileged or non-public routes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.