PT-2021-3455 · Symfony · Symfony

Adrien Lamotte + 4 · Published 2021-06-17 · Updated 2024-03-06 · CVE-2021-32693

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symfony versions 5.3.0 through 5.3.1

Description A vulnerability in Symfony is related to firewall authentication. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other firewalls. This could be abused when the application defines different providers for each part of the application, allowing a user authenticated on a part of the application to be considered authenticated on the rest of the application.

Recommendations For Symfony versions 5.3.0 through 5.3.1, update to version 5.3.2 or later, where a patch ensures that the authenticated token is only available for the firewall that generates it. As a temporary workaround, consider restricting access to sensitive parts of the application to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2021-03315

BIT-SYMFONY-2021-32693

CVE-2021-32693

GHSA-RFCF-M67M-JCRQ

Affected Products

Symfony

References · 14

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2021-32693.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2021-32693.yaml · Exploit
• https://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728 · Patch
• https://github.com/symfony/symfony/security/advisories/GHSA-rfcf-m67m-jcrq · Patch
• https://github.com/symfony/security-http/commit/6bf4c31219773a558b019ee12e54572174ff8129 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32693 · Security Note
• https://osv.dev/vulnerability/GHSA-rfcf-m67m-jcrq · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03315 · Security Note
• https://symfony.com/blog/cve-2021-32693-authentication-granted-to-all-firewalls-instead-of-just-one · Vendor Advisory
• https://osv.dev/vulnerability/BIT-symfony-2021-32693 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32693 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32693 · Vendor Advisory
• https://github.com/symfony/security-http · Note
• https://symfony.com/cve-2021-32693 · Note