PT-2017-3871 · Symfony · Symfony

Stefano Angaran · Published 2017-11-17 · Updated 2022-05-14 · CVE-2017-16652

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions 2.7.x through 2.7.37 Symfony versions 2.8.x through 2.8.30 Symfony versions 3.2.x through 3.2.13 Symfony versions 3.3.x through 3.3.12

Description The issue is related to the generation of a redirect response by the DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler components in the Symfony platform, without checking the target path parameter. This can allow a remote attacker to conduct phishing attacks and gain access to protected information by using a specially crafted URI. The vulnerability can be exploited to mount effective phishing attacks, as it allows for an open redirect to an external domain.

Recommendations For Symfony versions 2.7.x through 2.7.37, update to version 2.7.38 or later. For Symfony versions 2.8.x through 2.8.30, update to version 2.8.31 or later. For Symfony versions 3.2.x through 3.2.13, update to version 3.2.14 or later. For Symfony versions 3.3.x through 3.3.12, update to version 3.3.13 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2019-04112

CVE-2017-16652

DLA-1707-1

DSA-4262-1

GHSA-R7P7-QR7P-2RRF

Affected Products

Symfony

References · 20

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2017-16652.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16652.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2017-16652.yaml · Exploit
• https://security-tracker.debian.org/tracker/CVE-2017-16652 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16652 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16652 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16652 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1707-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04112 · Security Note
• https://symfony.com/blog/cve-2017-16652-open-redirect-vulnerability-on-security-handlers · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4262-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16652 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-r7p7-qr7p-2rrf · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16652 · Security Note