PT-2023-7208 · Symfony · Symfony

Robertme · Published 2023-11-10 · Updated 2024-03-06 · CVE-2023-46733

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Symfony versions 5.4.21 through 5.4.30 Symfony versions 6.2.7 through 6.3.7

Description The issue is related to the incorrect management of sessions by the SessionStrategyListener function in the Symfony platform. This can allow a remote attacker to compromise the integrity of protected information. The problem arises when the user identifier does not change between the verification phase and successful login, but the token type changes from partially-authenticated to fully-authenticated. In such cases, the session ID should be regenerated to prevent possible session fixations, but this does not occur.

Recommendations For Symfony versions 5.4.21 through 5.4.30, update to version 5.4.31 or later. For Symfony versions 6.2.7 through 6.3.7, update to version 6.3.8 or later. As a temporary workaround, consider regenerating the session ID after every successful login to prevent possible session fixations.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BDU:2023-08236

BIT-SYMFONY-2023-46733

CVE-2023-46733

GHSA-M2WJ-R6G3-FXFX

Affected Products

Symfony

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46733.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2023-46733.yaml · Exploit
• https://github.com/symfony/symfony/security/advisories/GHSA-m2wj-r6g3-fxfx · Vendor Advisory
• https://github.com/symfony/symfony/commit/dc356499d5ceb86f7cf2b4c7f032eca97061ed74 · Patch
• https://github.com/symfony/symfony/commit/7467bd7e3f888b333102bc664b5e02ef1e7f88b9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-46733 · Security Note
• https://bdu.fstec.ru/vul/2023-08236 · Security Note
• https://osv.dev/vulnerability/CVE-2023-46733 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-46733 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-46733 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-46733 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-46733 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m2wj-r6g3-fxfx · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-46733 · Security Note
• https://osv.dev/vulnerability/BIT-symfony-2023-46733 · Vendor Advisory