Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's session. This issue has been patched and is available for branch 4.4.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The     Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and     returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might     contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill     stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's     session. This issue has been patched and is available for branch 4.4. (CVE-2022-24894)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7272-1 advisory.

    Soner Sayakci discovered that Symfony incorrectly handled cookie storage in the web cache. An attacker     could possibly use this issue to obtain sensitive information and access unauthorized resources.
    (CVE-2022-24894)

    Marco Squarcina discovered that Symfony incorrectly handled the storage of user session information. An     attacker could possibly use this issue to perform a cross-site request forgery (CSRF) attack.
    (CVE-2022-24895)

    Pierre Rudloff discovered that Symfony incorrectly checked HTML input. An attacker could possibly use this     issue to perform cross site scripting. (CVE-2023-46734)

    Vladimir Dusheyko discovered that Symfony incorrectly sanitized special input with a PHP directive in URL     query strings. An attacker could possibly use this issue to expose sensitive information or cause a denial     of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-50340)

    Oleg Andreyev, Antoine Makdessi, and Moritz Rauch discovered that Symfony incorrectly handled user     authentication. An attacker could possibly use this issue to access unauthorized resources and expose     sensitive information. This issue was only addressed in Ubuntu 24.04 LTS. (CVE-2024-50341, CVE-2024-51996)

    Linus Karlsson and Chris Smith discovered that Symfony returned internal host information during host     resolution. An attacker could possibly use this issue to obtain sensitive information. This issue only     affected Ubuntu 24.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-50342)

    It was discovered that Symfony incorrectly parsed user input through regular expressions. An attacker     could possibly use this issue to expose sensitive information. (CVE-2024-50343)

    Sam Mush discovered that Symfony incorrectly parsed URIs with special characters. An attacker could     possibly use this issue to perform phishing attacks. (CVE-2024-50345)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The
    Symfony HTTP cache system, acts as a reverse proxy: It caches entire responses (including headers) and
    returns them to the clients. In a recent change in the `AbstractSessionListener`, the response might
    contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this response might bill
    stored and return to the next clients. An attacker can use this vulnerability to retrieve the victim's
    session. This issue has been patched and is available for branch 4.4. (CVE-2022-24894)

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3493 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3493-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     July 11, 2023                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : symfony     Version        : 3.4.22+dfsg-2+deb10u2     CVE ID         : CVE-2021-21424 CVE-2022-24894 CVE-2022-24895

    Multiple security vulnerabilities were found in symfony, a PHP framework     for web and console applications and a set of reusable PHP components,     which could lead to information disclosure or impersonation.

    CVE-2021-21424

        James Isaac, Mathias Brodala and Laurent Minguet discovered that it         was possible to enumerate users without relevant permissions due to         different exception messages depending on whether the user existed         or not.  It was also possible to enumerate users by using a timing         attack, by comparing time elapsed when authenticating an existing         user and authenticating a non-existing user.

        403s are now returned whether the user exists or not if a user         cannot switch to a user or if the user does not exist.

    CVE-2022-24894

        Soner Sayakci discovered that when the Symfony HTTP cache system is         enabled, the response header might be stored with a `Set-Cookie`         header and returned to some other clients, thereby allowing an         attacker to retrieve the victim's session.

        The `HttpStore` constructor now takes a parameter containing a list         of private headers that are removed from the HTTP response headers.
        The default value for this parameter is `Set-Cookie`, but it can be         overridden or extended by the application.

    CVE-2022-24895

        Marco Squarcina discovered that CSRF tokens aren't cleared upon         login, which could enable same-site attackers to bypass the CSRF         protection mechanism by performing an attack similar to a         session-fixation.

    For Debian 10 buster, these problems have been fixed in version     3.4.22+dfsg-2+deb10u2.

    We recommend that you upgrade your symfony packages.

    For the detailed security status of symfony please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/symfony

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-74b702f058 advisory.

    **Version  4.4.50** (2023-02-01)

     * **security cve-2022-24895** [Security/Http] Remove CSRF tokens from storage on successful login     (nicolas-grekas)
     * **security cve-2022-24894** [HttpKernel] Remove private headers before storing responses with HttpCache     (nicolas-grekas)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-aecde14648 advisory.

    **Version  4.4.50** (2023-02-01)

     * **security cve-2022-24895** [Security/Http] Remove CSRF tokens from storage on successful login     (nicolas-grekas)
     * **security cve-2022-24894** [HttpKernel] Remove private headers before storing responses with HttpCache     (nicolas-grekas)




Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
224516	Linux Distros Unpatched Vulnerability : CVE-2022-24894	Nessus	Misc.	high
216425	Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : Symfony vulnerabilities (USN-7272-1)	Nessus	Ubuntu Local Security Checks	high
415576	SCA: security update for symfony/http-kernel, symfony/symfony (GHSA-h7vf-5wrv-9fhv)	Tenable Cloud Security	SCA Checks	high
415576	SCA: security update for symfony/http-kernel, symfony/symfony (GHSA-h7vf-5wrv-9fhv)	Tenable Self-Hosted Container Security	SCA Checks	high
178174	Debian dla-3493 : php-symfony - security update	Nessus	Debian Local Security Checks	high
171375	Fedora 37 : php-symfony4 (2023-74b702f058)	Nessus	Fedora Local Security Checks	high
171373	Fedora 36 : php-symfony4 (2023-aecde14648)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2022-24894

high

Tenable Plugins

high

high

high

high

high

high

high