PT-2021-23229 · Symfony · Symfony/Securitybundle

Thibaut Decherit · Published 2021-11-24 · Updated 2024-03-06 · CVE-2021-41268

Positive Technologies · (AI Summary)

CVSS v3.1

6.5

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions:

Symfony/SecurityBundle versions 5.3.0 through 5.3.11

Description:

The issue arises from the rework of the Remember me cookie in Symfony version 5.3.0, where the cookie is not invalidated when a user changes their password. This allows attackers to maintain access to an account even after a password change, provided they have previously logged in and obtained a valid remember me cookie. Starting with version 5.3.12, Symfony includes the password in the signature by default, rendering the cookie invalid upon password change.

Recommendations:

For Symfony/SecurityBundle versions 5.3.0 through 5.3.11, update to version 5.3.12 or later, where Symfony makes the password part of the signature by default, thus invalidating the remember me cookie when the password is changed.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BIT-SYMFONY-2021-41268

CVE-2021-41268

GHSA-QW36-P97W-VCQR

Affected Products

Symfony/Securitybundle

References · 15

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2021-41268.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2021-41268.yaml · Exploit
• https://github.com/symfony/symfony/pull/44243 · Patch
• https://github.com/symfony/symfony/security/advisories/GHSA-qw36-p97w-vcqr · Patch
• https://github.com/symfony/symfony/commit/36a808b857cd3240244f4b224452fb1e70dc6dfc · Patch
• https://osv.dev/vulnerability/BIT-symfony-2021-41268 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41268 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41268 · Security Note
• https://osv.dev/vulnerability/GHSA-qw36-p97w-vcqr · Vendor Advisory
• https://github.com/symfony/symfony/releases/tag/v5.3.12 · Note
• https://github.com/symfony/symfony · Note
• https://t.me/cibsecurity/32976 · Telegram Post
• https://symfony.com/cve-2021-41268 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41268 · Note
• https://t.me/cvenotify/23743 · Telegram Post