CVE-2018-19790: Symfony Open Redirect in symfony/security-http
Summary
CVE-2018-19790: Symfony Open Redirect. Affects symfony/security-http across 6 version ranges.
>= 2.7.38, < 2.7.50
>= 2.8.0, < 2.8.49
>= 3.0.0, < 3.4.20
>= 4.0.0, < 4.0.15
>= 4.1.0, < 4.1.9
>= 4.2.0, < 4.2.1
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- symfony · Debian:11
The same CVE-2018-19790 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The symfony/security-http package is a component of the Symfony framework that provides security features for HTTP requests. It includes functionality for handling authentication, authorization, and other security-related tasks. This package is widely used in Symfony-based applications to ensure secure communication between clients and servers.
Vulnerability Detail
An open redirect vulnerability was discovered in versions 2.7.x through 2.7.49, 2.8.x through 2.8.48, 3.x through 3.4.19, 4.0.x through 4.0.14, 4.1.x through 4.1.8, and 4.2.x through 4.2.0 of the symfony/security-http package. This vulnerability allows an attacker to bypass redirection target restrictions by using backslashes in the _failure_path input field of login forms. By exploiting this vulnerability, an attacker can redirect users to any domain after login, potentially leading to phishing attacks or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.7.38, < 2.7.502.7.50composer require symfony/security-http:2.7.50 -
>= 2.8.0, < 2.8.492.8.49composer require symfony/security-http:2.8.49 -
>= 3.0.0, < 3.4.203.4.20composer require symfony/security-http:3.4.20 -
>= 4.0.0, < 4.0.154.0.15composer require symfony/security-http:4.0.15 -
>= 4.1.0, < 4.1.94.1.9composer require symfony/security-http:4.1.9 -
>= 4.2.0, < 4.2.14.2.1composer require symfony/security-http:4.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the latest version of the symfony/security-http package.
Conclusion
The open redirect vulnerability in the symfony/security-http package can allow attackers to redirect users to arbitrary domains after login. To mitigate this vulnerability, it is crucial to upgrade to the latest fixed version of the package. It is also recommended to regularly monitor for vulnerabilities in your application using tools like Vulert (https://vulert.com) to ensure timely patching and protection against potential exploits.
See every vulnerability recorded for symfony/security-http →
FAQ
An open redirect vulnerability occurs when a web application allows unauthorized users to redirect users to arbitrary external URLs. This can be exploited by attackers to trick users into visiting malicious websites or disclosing sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it to identify any vulnerable packages.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory. However, it is important to apply the recommended fix to prevent potential exploitation.
While it is technically possible to manually modify the affected code to fix the vulnerability, it is strongly recommended to apply the official fix provided by the Symfony project. Manual modifications may introduce errors or compatibility issues, and they may be overwritten when updating the package in the future.
You can find more information about this vulnerability, including the technical details and the fix, in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-89r2-5g34-2g47/GHSA-89r2-5g34-2g47.json).
Related vulnerabilities
Recent vulnerabilities recorded for symfony/security-http.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
