Critical Brute Force Vulnerability in Auth0 Symfony SDK
Summary
GHSA-9wg9-93h9-j8ch: Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions. Affects auth0/symfony versions < 5.4.0. Fixed in 5.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Auth0 Symfony SDK is a library that integrates Auth0's authentication services into Symfony applications, providing developers with tools to manage user authentication and authorization seamlessly. This SDK is widely used for its ease of integration and robust security features. However, a critical vulnerability has been identified in versions up to 5.3.1, specifically when configured with CookieStore for session storage, which exposes applications to brute force attacks on session cookies.
Vulnerability Detail
The vulnerability arises from the authentication tags in session cookies used by the Auth0 Symfony SDK when configured with CookieStore. These tags can be brute-forced, potentially allowing unauthorized access to user sessions. The affected versions include Auth0 Symfony SDK versions up to 5.3.1 and Auth0-PHP SDK versions between 8.0.0-BETA1 and 8.14.0. If exploited, this vulnerability can lead to severe security breaches, compromising user data and application integrity.
How To Fix
Minimum fixed version
5.4.0
This is the first release that contains the fix.
composer require auth0/symfony:5.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider switching to a different session storage mechanism instead of CookieStore until the upgrade can be performed. This can be done by configuring your Symfony application to use a database or file-based session storage.
Conclusion
In summary, the Auth0 Symfony SDK has a critical vulnerability that allows for brute force attacks on session cookies when using CookieStore. It is essential to upgrade to version 5.4.0 or higher and rotate cookie encryption keys to mitigate the risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for auth0/symfony →
FAQ
Versions of Auth0 Symfony SDK up to 5.3.1 are affected by this vulnerability.
The CVSS score of this vulnerability is 9.1, indicating a critical severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, consider switching to a different session storage mechanism as a temporary workaround.
This vulnerability was discovered by Félix Charette.
References
Related vulnerabilities
Recent vulnerabilities recorded for auth0/symfony.
