PT-2018-3150 · Symfony · Symfony

Kévin Liagre · Published 2018-05-25 · Updated 2022-05-14 · CVE-2018-11406

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symfony versions 2.7.x through 2.7.47 Symfony versions 2.8.x through 2.8.40 Symfony versions 3.3.x through 3.3.16 Symfony versions 3.4.x through 3.4.10 Symfony versions 4.0.x through 4.0.10

Description An issue in the Security component of Symfony allows for CSRF token fixation when the invalidate session option is disabled. By default, a user's session is invalidated when the user is logged out, but with this option disabled, CSRF tokens are not erased during logout. This behavior can be exploited to allow for cross-site request forgery.

Recommendations For Symfony versions 2.7.x through 2.7.47, update to version 2.7.48 or later. For Symfony versions 2.8.x through 2.8.40, update to version 2.8.41 or later. For Symfony versions 3.3.x through 3.3.16, update to version 3.3.17 or later. For Symfony versions 3.4.x through 3.4.10, update to version 3.4.11 or later. For Symfony versions 4.0.x through 4.0.10, update to version 4.0.11 or later. As a temporary workaround, consider enabling the invalidate session option to ensure CSRF tokens are erased during logout.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2019-04245

CVE-2018-11406

DSA-4262-1

GHSA-G4G7-Q726-V5HG

Affected Products

Symfony

References · 26

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11406.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2018-11406.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2018-11406.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-11406.yaml · Exploit
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11406 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-11406 · Security Note
• https://symfony.com/blog/cve-2018-11406-csrf-token-fixation · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-11406 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04245 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-11406 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=44892734 · Vendor Advisory