CVE-2018-11407: Symfony Authentication Bypass in symfony/security-core
Summary
CVE-2018-11407: Symfony Authentication Bypass. Affects symfony/security-core across 4 version ranges.
>= 2.8.0, < 2.8.37
>= 3.0.0, < 3.3.17
>= 3.4.0, < 3.4.7
>= 4.0.0, < 4.0.7
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- symfony · Debian:11
The same CVE-2018-11407 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The symfony/security-core package is a component of the Symfony framework that provides authentication and authorization features. It is responsible for handling user authentication and managing user roles and permissions. This package is widely used in Symfony-based applications to ensure secure access control and user management.
Vulnerability Detail
The vulnerability identified as CVE-2018-11407 allows remote attackers to bypass authentication in Symfony versions 2.8.x, 3.3.x, 3.4.x, and 4.0.x. By logging in with a 'null' password and a valid username, an unauthenticated bind is triggered, granting unauthorized access to the system. This vulnerability is a result of an incomplete fix for CVE-2016-2403.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.8.0, < 2.8.372.8.37composer require symfony/security-core:2.8.37 -
>= 3.0.0, < 3.3.173.3.17composer require symfony/security-core:3.3.17 -
>= 3.4.0, < 3.4.73.4.7composer require symfony/security-core:3.4.7 -
>= 4.0.0, < 4.0.74.0.7composer require symfony/security-core:4.0.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading the symfony/security-core package to the fixed versions.
Conclusion
The CVE-2018-11407 vulnerability in the symfony/security-core package allows for an authentication bypass, enabling unauthorized access to the system. To mitigate this vulnerability, it is crucial to upgrade the package to the fixed versions. No known workarounds exist for this issue. For additional support and guidance, please reach out to DevNack.com.
See every vulnerability recorded for symfony/security-core →
FAQ
This vulnerability allows remote attackers to bypass authentication and gain unauthorized access to the system, potentially compromising sensitive data and performing malicious actions.
Symfony versions 2.8.x, 3.3.x, 3.4.x, and 4.0.x are affected by this vulnerability.
No, there is no known workaround. It is essential to apply the recommended fix by upgrading the symfony/security-core package.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will provide real-time alerts for open-source vulnerabilities.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in resolving this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/security-core.
