Symfony X.509 certificate login can be spoofed, plus related flaws
Certificate logins in this PHP web tool let attackers enter other users' accounts.
Summary
Symfony's X.509 certificate login reads DN values incorrectly, so an attacker holding a certificate from the application's trusted CA can sign in as another user, including an administrator. Applications that log users in from Apache or nginx DN values are affected.
Affected when
- X.509 certificate login without a per-attribute user key
- Attacker holding a certificate from the app's trusted CA can influence the CN
- Host placeholder routes protected by path-based access rules
What to do
Update to Symfony 5.4.56, 6.4.50, 7.4.23 or 8.1.11 for your branch, then clear the cache.
Update to at least the version for your product:
- Symfony 5.4 5.4.56 or later
- Symfony 6.4 6.4.50 or later
- Symfony 7.4 7.4.23 or later
- Symfony 8.1 8.1.11 or later
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen