PT-2023-1575 · Symfony+4 · Symfony+4

Marco Squarcina · Published 2023-02-01 · Updated 2025-02-18 · CVE-2022-24895

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 4.4

Description The issue is related to incorrect session management in Symfony, a PHP framework for web and console applications. When authenticating users, Symfony by default regenerates the session ID upon login but preserves the rest of session attributes, including CSRF tokens. This might enable same-site attackers to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.

Recommendations For versions prior to 4.4, update to version 4.4 or later, which includes the fix for this issue. As a temporary workaround, consider manually clearing CSRF tokens from the session on successful login to prevent potential exploitation.

Exploit

Fix

Session Fixation

Insufficient Session Expiration

Weakness Enumeration

CWE-384

CWE-613

Related Identifiers

BDU:2023-01057

BIT-SYMFONY-2022-24895

CVE-2022-24895

DLA-3493-1

GHSA-3GV2-29QC-V67M

USN-7272-1

Affected Products

Astra Linux

Linuxmint

Red Os

Symfony

Ubuntu

References · 38

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24895.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2022-24895.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2022-24895.yaml · Exploit
• https://github.com/symfony/symfony/security/advisories/GHSA-3gv2-29qc-v67m · Patch
• https://github.com/symfony/symfony/commit/5909d74ecee359ea4982fcf4331aaf2e489a1fd4 · Patch
• https://github.com/symfony/security-bundle/commit/076fd2088ada33d760758d98ff07ddedbf567946 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24895 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01057 · Security Note
• https://ubuntu.com/security/CVE-2024-51996 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24895 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-symfony-2022-24895 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3493-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24895 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50345 · Vendor Advisory