PT-2021-3445 · Symfony+3 · Symfony+3

Chalasr · Published 2021-05-13 · Updated 2024-03-06 · CVE-2021-21424

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 3.4

Description The issue is related to information disclosure, allowing a remote attacker to gain unauthorized access to protected information. The vulnerability is caused by the ability to enumerate users without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. Additionally, it was possible to enumerate users by using a timing attack, comparing the time elapsed when authenticating an existing user and a non-existing user.

Recommendations For Symfony versions prior to 3.4, the patch for this issue is available for branch 3.4, ensuring that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. As a temporary workaround, consider restricting access to the switch users functionality until the patch is applied.

Exploit

Fix

Side Channel Attack

Information Disclosure

Weakness Enumeration

CWE-203

CWE-200

Related Identifiers

BDU:2021-03305

BIT-SYMFONY-2021-21424

CVE-2021-21424

DLA-3493-1

GHSA-5PV8-PPVJ-4H68

USN-5290-1

Affected Products

Astra Linux

Linuxmint

Symfony

Ubuntu

References · 42

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2021-21424.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2021-21424.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/lexik/jwt-authentication-bundle/CVE-2021-21424.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/maker-bundle/CVE-2021-21424.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2021-21424.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-guard/CVE-2021-21424.yaml · Exploit
• https://github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68 · Patch
• https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21424 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-21424 · Security Note
• https://osv.dev/vulnerability/DLA-3493-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-1031SE47 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRUS2H2SSOQWNLBD35SKIWIDQEMV2PD3 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KENRNLB3FYXYGDWRBH2PDBOZZKOD7VY4 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH7TMM5CHQYBFFGXWRPJDPB3SKCZXI2M · Vendor Advisory