Symfony Profiler open - Vulnerability Database

Symfony Profiler open

Description

The Symfony Profiler is a development tool that provides detailed debugging information about application requests, including configuration details, database queries, routing information, and environment variables. When left enabled in production environments or accessible without authentication, it exposes sensitive technical details about the application's internal architecture and data flow.

Remediation

Disable the Symfony Profiler in production environments by setting the profiler configuration to false. In your config/packages/prod/web_profiler.yaml file, ensure the profiler is disabled:

framework:
    profiler: false

Alternatively, verify that the profiler is only enabled in development mode by checking config/packages/dev/web_profiler.yaml and ensuring production environments use the prod configuration. If the profiler must remain accessible for debugging purposes, restrict access using IP whitelisting or firewall rules to allow only trusted internal networks, and implement strong authentication mechanisms.