SB2019111915 - Multiple vulnerabilities in Symfony

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Incorrect Comparison (CVE-ID: CVE-2019-18887)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists within the HttpKernel component in Symfony when checking the signature of an URI (an ESI fragment URL for instance) due to the URISigner does not use a constant time string comparison function. A remote attacker can perform a timing attack and gain access to sensitive functionality.

2) Deserialization of Untrusted Data (CVE-ID: CVE-2019-18889)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data in the AbstractAdapter and TagAwareAdapter instances within the Symfony Cache component. A remote attacker can pass specially crafted data to to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

3) OS Command Injection (CVE-ID: CVE-2019-18888)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists in MimeTypeGuesser within the Symfony HttpFoundation component when parsing data passed via the $path variable. A remote attacker can with ability to upload files can execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) Improper control of interaction frequency (CVE-ID: CVE-2019-18886)

The vulnerability allows a remote attacker to gain access to sensitive information on the target system.

The vulnerability exists in the "Security/Http" component due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. A remote attacker can enumerate users on the target system.

5) Code Injection (CVE-ID: CVE-2019-11325)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to some strings are not properly escaped when being dumped by the "VarExporter" component. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• https://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner
• https://github.com/symfony/symfony/commit/cccefe6a7f12e776df0665aeb77fe9294c285fbb
• https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances
• https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser
• https://github.com/symfony/symfony/releases/tag/v4.3.8
• https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionality
• https://symfony.com/blog/symfony-4-3-8-released
• https://github.com/symfony/var-exporter/compare/d8bf442...57e00f3
• https://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter