Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula injection. In Symfony 4.1, maintainers added the opt-in `csv_escape_formulas` option in the `CsvEncoder`, to prefix all cells starting with `=`, `+`, `-` or `@` with a tab `\t`. Since then, OWASP added 2 chars in that list: Tab (0x09) and Carriage return (0x0D). This makes the previous prefix char (Tab `\t`) part of the vulnerable characters, and OWASP suggests using the single quote `'` for prefixing the value. Starting with versions 4.4.34 and 5.3.12, Symfony now follows the OWASP recommendations and uses the single quote `'` to prefix formulas and add the prefix to cells starting by `\t`, `\r` as well as `=`, `+`, `-` and `@`.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for
    web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35
    and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula injection. In
    Symfony 4.1, maintainers added the opt-in `csv_escape_formulas` option in the `CsvEncoder`, to prefix all
    cells starting with `=`, `+`, `-` or `@` with a tab `\t`. Since then, OWASP added 2 chars in that list:
    Tab (0x09) and Carriage return (0x0D). This makes the previous prefix char (Tab `\t`) part of the
    vulnerable characters, and OWASP suggests using the single quote `'` for prefixing the value. Starting
    with versions 4.4.34 and 5.3.12, Symfony now follows the OWASP recommendations and uses the single quote
    `'` to prefix formulas and add the prefix to cells starting by `\t`, `\r` as well as `=`, `+`, `-` and
    `@`. (CVE-2021-41270)

The remote Ubuntu 18.04 ESM / 20.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5290-1 advisory.

    James Isaac and Mathias Brodala discovered that Symfony incorrectly handled switch users functionality. An     attacker could possibly use this issue to enumerate users. (CVE-2021-21424)

    It was discovered that Symfony incorrectly handled certain specially crafted CSV files. An attacker could     possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 20.04 ESM.
    (CVE-2021-41270)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
409171	SCA: security update for symfony/serializer, symfony/symfony (GHSA-2xhg-w2g5-w95x)	Tenable Cloud Security	SCA Checks	Local	medium
409171	SCA: security update for symfony/serializer, symfony/symfony (GHSA-2xhg-w2g5-w95x)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
183134	Ubuntu 18.04 ESM / 20.04 ESM : Symfony vulnerabilities (USN-5290-1)	Nessus	Ubuntu Local Security Checks	Local	medium

Detections

Analytics

CVE-2021-41270

medium

Tenable Plugins

medium

medium

medium