Critical Security Flaw in Symfony Package: Unchecked User Login via Security::login Method
Summary
DEBIAN-CVE-2024-50341: symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. Affects symfony versions < 6.4.10+dfsg-1. Fixed in 6.4.10+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Symfony is a popular PHP framework that provides a robust set of tools for building web applications. The symfony/security-bundle module integrates the Security component into the Symfony framework, allowing developers to manage user authentication and authorization effectively. This package is widely used in various applications, making its security a top priority for developers and users alike.
Vulnerability Detail
The vulnerability arises from a flaw in the custom user_checker defined on a firewall, which is not invoked when users log in programmatically using the Security::login method. This oversight can lead to unauthorized access, as the necessary checks to validate user credentials are bypassed. The issue has been addressed in versions 6.4.10, 7.0.10, and 7.1.3, where the Security::login method has been updated to ensure that the configured user_checker is called, thereby enhancing security.
How To Fix
Minimum fixed version
6.4.10+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade symfonyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The best course of action is to upgrade to the patched version of the Symfony package as mentioned above.
Conclusion
The vulnerability in the Symfony package poses a significant risk by allowing unauthorized logins due to a flaw in the Security::login method. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for symfony →
FAQ
The vulnerability allows unauthorized login due to the user_checker not being called during programmatic logins.
Versions prior to 6.4.10, 7.0.10, and 7.1.3 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
It is highly recommended to upgrade to the patched version as there are no known workarounds for this vulnerability.
Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in your software.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
