PT-2022-6951 · Symfony · Symfony

Catalin Dan + 1 · Published 2022-02-01 · Updated 2024-03-06 · CVE-2022-23601

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symfony versions prior to the patch versions listed

Description The issue is related to insufficient authentication of executed requests in the Symfony framework, which can allow a remote attacker to perform a CSRF attack. The Symfony form component provides a CSRF protection mechanism using a random token injected in the form and stored in the session. However, due to a recent change in the configuration loading, the default behavior of enabling CSRF protection has been dropped, making applications sensitive to CSRF attacks when the protection is not explicitly enabled.

Recommendations For Symfony versions prior to the patch versions listed, update to a version that includes the patch to resolve the issue. As a temporary workaround, consider enabling the CSRF protection mechanism explicitly in the configuration to prevent CSRF attacks.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2023-05710

BIT-SYMFONY-2022-23601

CVE-2022-23601

GHSA-VVMR-8829-6WHX

Affected Products

Symfony

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23601.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/framework-bundle/CVE-2022-23601.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2022-23601.yaml · Exploit
• https://github.com/symfony/symfony/commit/f0ffb775febdf07e57117aabadac96fa37857f50 · Patch
• https://github.com/symfony/symfony/security/advisories/GHSA-vvmr-8829-6whx · Patch
• https://bdu.fstec.ru/vul/2023-05710 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-23601 · Security Note
• https://osv.dev/vulnerability/BIT-symfony-2022-23601 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23601 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-23601 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vvmr-8829-6whx · Vendor Advisory
• https://github.com/symfony/symfony · Note
• https://symfony.com/cve-2022-23601 · Note
• https://t.me/cibsecurity/36626 · Telegram Post