CVE-2022-24895: Symfony Security Bundle - Session Fixation of CSRF Tokens
Summary
CVE-2022-24895: Symfony vulnerable to Session Fixation of CSRF tokens. Affects symfony/security-bundle across 5 version ranges.
>= 2.0.0, < 4.4.50
>= 5.0.0, < 5.4.20
>= 6.0.0, < 6.0.20
>= 6.1.0, < 6.1.12
>= 6.2.0, < 6.2.6
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
The same CVE-2022-24895 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Symfony Security Bundle is a component of the Symfony framework that provides various security features for web applications. It includes functionality for authentication, authorization, and protection against common security threats. This vulnerability affects versions 2.0.0 to 4.4.50, 5.0.0 to 5.4.20, 6.0.0 to 6.0.20, 6.1.0 to 6.1.12, and 6.2.0 to 6.2.6 of the Symfony Security Bundle.
Vulnerability Detail
The vulnerability in the Symfony Security Bundle allows for session fixation of CSRF tokens. Upon user authentication, Symfony regenerates the session ID but preserves the rest of the session attributes, including CSRF tokens. This can enable same-site attackers to bypass CSRF protection by performing an attack similar to session fixation. The impact of this vulnerability can lead to unauthorized actions being performed on behalf of the user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 4.4.504.4.50composer require symfony/security-bundle:4.4.50 -
>= 5.0.0, < 5.4.205.4.20composer require symfony/security-bundle:5.4.20 -
>= 6.0.0, < 6.0.206.0.20composer require symfony/security-bundle:6.0.20 -
>= 6.1.0, < 6.1.126.1.12composer require symfony/security-bundle:6.1.12 -
>= 6.2.0, < 6.2.66.2.6composer require symfony/security-bundle:6.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the Symfony Security Bundle to the fixed version as soon as possible.
Conclusion
The Symfony Security Bundle is vulnerable to session fixation of CSRF tokens, which can enable same-site attackers to bypass CSRF protection. To mitigate this vulnerability, it is crucial to update the Symfony Security Bundle to the fixed version. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for symfony/security-bundle →
FAQ
This vulnerability can allow same-site attackers to bypass CSRF protection and perform unauthorized actions on behalf of the user.
Versions 2.0.0 to 4.4.50, 5.0.0 to 5.4.20, 6.0.0 to 6.0.20, 6.1.0 to 6.1.12, and 6.2.0 to 6.2.6 of the Symfony Security Bundle are affected.
To fix this vulnerability, update the Symfony Security Bundle to version 4.4.50, 5.4.20, 6.0.20, 6.1.12, or 6.2.6.
There is no known workaround for this vulnerability. Updating to the fixed version is recommended.
You can find more information about this vulnerability in the provided source link.
References
Related vulnerabilities
Recent vulnerabilities recorded for symfony/security-bundle.
