PT-2023-1579 · Symfony+5 · Symfony+5

Soner Sayakci · Published 2023-02-01 · Updated 2025-04-10 · CVE-2022-24894

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Symfony versions prior to 4.4

Description The Symfony HTTP cache system acts as a reverse proxy, caching entire responses, including headers, and returning them to clients. A recent change in the AbstractSessionListener may cause the response to contain a Set-Cookie header. If the Symfony HTTP cache system is enabled, this response might be stored and returned to other clients, allowing an attacker to retrieve the victim's session.

Recommendations For versions prior to 4.4, update to branch 4.4 to resolve the issue. As a temporary workaround, consider disabling the AbstractSessionListener or restricting access to the Symfony HTTP cache system until the patch is applied. The HttpStore constructor now takes a parameter containing a list of private headers that are removed from the HTTP response headers, with the default value being Set-Cookie, which can be overridden or extended by the application.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

ALT-PU-2023-6184

ALT-PU-2024-4537

ALT-PU-2024-4547

ALT-PU-2024-4961

BDU:2023-01072

BIT-SYMFONY-2022-24894

CVE-2022-24894

DLA-3493-1

GHSA-H7VF-5WRV-9FHV

USN-7272-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Red Os

Symfony

Ubuntu

References · 37

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24894.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2022-24894.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2022-24894.yaml · Exploit
• https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-24894 · Security Note
• https://ubuntu.com/security/CVE-2024-51996 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24895 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3493-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h7vf-5wrv-9fhv · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01072 · Security Note
• https://ubuntu.com/security/CVE-2024-50345 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-50340 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24894 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24894 · Vendor Advisory