Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The
    ability to enumerate users was possible without relevant permissions due to different handling depending
    on whether the user existed or not when attempting to use the switch users functionality. We now ensure
    that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user
    does not exist. The patch for this issue is available for branch 3.4. (CVE-2021-21424)

The remote Ubuntu 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5290-1 advisory.

    James Isaac and Mathias Brodala discovered that Symfony incorrectly handled switch users functionality. An     attacker could possibly use this issue to enumerate users. (CVE-2021-21424)

    It was discovered that Symfony incorrectly handled certain specially crafted CSV files. An attacker could     possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 ESM.
    (CVE-2021-41270)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3493 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3493-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     July 11, 2023                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : symfony     Version        : 3.4.22+dfsg-2+deb10u2     CVE ID         : CVE-2021-21424 CVE-2022-24894 CVE-2022-24895

    Multiple security vulnerabilities were found in symfony, a PHP framework     for web and console applications and a set of reusable PHP components,     which could lead to information disclosure or impersonation.

    CVE-2021-21424

        James Isaac, Mathias Brodala and Laurent Minguet discovered that it         was possible to enumerate users without relevant permissions due to         different exception messages depending on whether the user existed         or not.  It was also possible to enumerate users by using a timing         attack, by comparing time elapsed when authenticating an existing         user and authenticating a non-existing user.

        403s are now returned whether the user exists or not if a user         cannot switch to a user or if the user does not exist.

    CVE-2022-24894

        Soner Sayakci discovered that when the Symfony HTTP cache system is         enabled, the response header might be stored with a `Set-Cookie`         header and returned to some other clients, thereby allowing an         attacker to retrieve the victim's session.

        The `HttpStore` constructor now takes a parameter containing a list         of private headers that are removed from the HTTP response headers.
        The default value for this parameter is `Set-Cookie`, but it can be         overridden or extended by the application.

    CVE-2022-24895

        Marco Squarcina discovered that CSRF tokens aren't cleared upon         login, which could enable same-site attackers to bypass the CSRF         protection mechanism by performing an attack similar to a         session-fixation.

    For Debian 10 buster, these problems have been fixed in version     3.4.22+dfsg-2+deb10u2.

    We recommend that you upgrade your symfony packages.

    For the detailed security status of symfony please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/symfony

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
410967	SCA: security update for lexik/jwt-authentication-bundle, symfony/maker-bundle, symfony/security, symfony/security-core, symfony/security-guard, symfony/security-http, symfony/symfony (GHSA-5pv8-ppvj-4h68)	Tenable Cloud Security	SCA Checks	medium
410967	SCA: security update for lexik/jwt-authentication-bundle, symfony/maker-bundle, symfony/security, symfony/security-core, symfony/security-guard, symfony/security-http, symfony/symfony (GHSA-5pv8-ppvj-4h68)	Tenable Self-Hosted Container Security	SCA Checks	medium
183134	Ubuntu 18.04 ESM / 20.04 ESM : Symfony vulnerabilities (USN-5290-1)	Nessus	Ubuntu Local Security Checks	medium
178174	Debian dla-3493 : php-symfony - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2021-21424

medium

Tenable Plugins

medium

medium

medium

high