PT-2017-3872 · Symfony · Symfony

Oliver Hoff · Published 2017-11-17 · Updated 2022-05-13 · CVE-2017-16653

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 2.7.38 Symfony versions prior to 2.8.31 Symfony versions prior to 3.2.14 Symfony versions prior to 3.3.13 Symfony versions prior to 3.4-BETA5 Symfony versions prior to 4.0-BETA5

Description The issue is related to the CSRF protection in Symfony, where the current implementation does not use different tokens for HTTP and HTTPS. This makes the token subject to Man-In-The-Middle (MITM) attacks on HTTP, which can then be used in an HTTPS context to perform CSRF attacks. The vulnerability can allow a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 2.7.38, update to version 2.7.38 or later. For versions prior to 2.8.31, update to version 2.8.31 or later. For versions prior to 3.2.14, update to version 3.2.14 or later. For versions prior to 3.3.13, update to version 3.3.13 or later. For versions prior to 3.4-BETA5, update to version 3.4-BETA5 or later. For versions prior to 4.0-BETA5, update to version 4.0-BETA5 or later.

Exploit

Fix

CSRF

Information Disclosure

Weakness Enumeration

CWE-352

CWE-200

CWE-16

Related Identifiers

BDU:2019-04113

CVE-2017-16653

DSA-4262-1

GHSA-92X6-H2GR-8GXQ

Affected Products

Symfony

References · 20

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16653.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2017-16653.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-csrf/CVE-2017-16653.yaml · Exploit
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16653 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16653 · Security Note
• https://debian.org/security/2018/dsa-4262 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4262-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16653 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16653 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-16653 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16653 · Security Note
• https://osv.dev/vulnerability/GHSA-92x6-h2gr-8gxq · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16653 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04113 · Security Note