PT-2023-1575 · Symfony+4 · Symfony+4

Marco Squarcina · Publicado 2023-02-01 · Atualizado 2025-02-18 · CVE-2022-24895

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 4.4

Description The issue is related to incorrect session management in Symfony, a PHP framework for web and console applications. When authenticating users, Symfony by default regenerates the session ID upon login but preserves the rest of session attributes, including CSRF tokens. This might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.

Recommendations For versions prior to 4.4, update to version 4.4 or later, which includes the fix for this issue. As a temporary workaround, consider manually clearing CSRF tokens from the session on successful login to prevent potential exploitation.

Exploit

Correção

Session Fixation

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-384

CWE-613

Identificadores relacionados

BDU:2023-01057

BIT-SYMFONY-2022-24895

CVE-2022-24895

DLA-3493-1

GHSA-3GV2-29QC-V67M

USN-7272-1

Produtos afetados

Astra Linux

Linuxmint

Red Os

Symfony

Ubuntu

Referências · 38

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24895.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2022-24895.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2022-24895.yaml · Exploit
• https://github.com/symfony/symfony · Nota
• https://github.com/symfony/symfony/commit/5909d74ecee359ea4982fcf4331aaf2e489a1fd4 · Correção
• https://github.com/symfony/symfony/security/advisories/GHSA-3gv2-29qc-v67m · Correção
• https://github.com/symfony/security-bundle/commit/076fd2088ada33d760758d98ff07ddedbf567946 · Correção
• https://ubuntu.com/security/CVE-2024-50340 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-24895 · Nota de Segurança
• https://ubuntu.com/security/CVE-2024-50343 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2024-50345 · Aviso do Fabricante
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-php-symfony4-cve-2022-24894-cve-2022-24895-cve-2023-46734 · Nota
• https://osv.dev/vulnerability/DLA-3493-1 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01057 · Nota de Segurança