CVE-2024-50341: Symfony Security Bundle User Checker Bypass Vulnerability
Summary
CVE-2024-50341: Symfony's Security::login does not take into account custom user_checker. Affects symfony/security-bundle across 3 version ranges.
>= 6.2.0, < 6.4.10
>= 7.0.0, < 7.0.10
>= 7.1.0, < 7.1.3
Fixed in 6.4.10, 7.0.10 or 7.1.3, depending on the release line you run. How to fix ↓
Also tracked for
- symfony · Debian:13
The same CVE-2024-50341 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Symfony is a robust PHP framework widely used for building web applications. The Symfony Security Bundle provides essential security features, including authentication and authorization. It allows developers to define custom user checkers to enforce specific security rules during user login. However, a flaw in the Security::login method can lead to unauthorized access, as it does not invoke the custom user checker, potentially compromising application security.
Vulnerability Detail
The vulnerability arises from the Security::login method in Symfony's Security Bundle, which fails to call the configured custom user_checker during programmatic login. This oversight allows users to log in without the necessary checks, leading to unauthorized access. The issue is particularly concerning as it can be exploited by attackers to gain access to sensitive areas of an application without proper validation, undermining the security model established by the developers.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.2.0, < 6.4.106.4.10composer require symfony/security-bundle:6.4.10 -
>= 7.0.0, < 7.0.107.0.10composer require symfony/security-bundle:7.0.10 -
>= 7.1.0, < 7.1.37.1.3composer require symfony/security-bundle:7.1.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement additional checks in their login logic to ensure that the custom user checker is manually invoked before allowing a user to log in. However, this is not a permanent solution and should be replaced with the official patch as soon as possible.
Conclusion
The CVE-2024-50341 vulnerability in the Symfony Security Bundle poses a significant risk by allowing unauthorized logins. It is crucial for developers to update to the patched versions to safeguard their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for symfony/security-bundle →
FAQ
CVE-2024-50341 is a vulnerability in the Symfony Security Bundle that allows unauthorized login due to the failure of the Security::login method to call the custom user checker.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your composer.lock file without any signup.
The main consequence is unauthorized access to applications, which can lead to data breaches and compromise sensitive information.
To apply the patch, update your Symfony Security Bundle to one of the fixed versions: 6.4.10, 7.0.10, or 7.1.3 using Composer.
Yes, you can implement additional checks in your login logic to manually invoke the custom user checker, but this should only be a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/security-bundle.
