Multiple vulnerabilities in Symfony
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2019-18887 CVE-2019-18889 CVE-2019-18888 CVE-2019-18886 CVE-2019-11325 |
| CWE-ID | CWE-697 CWE-502 CWE-78 CWE-799 CWE-94 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
Symfony Web applications / CMS |
| Vendor | SensioLabs |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Incorrect Comparison
EUVDB-ID: #VU22851
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-18887
CWE-ID:
CWE-697 - Incorrect Comparison
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists within the HttpKernel component in Symfony when checking the signature of an URI (an ESI fragment URL for
instance) due to the URISigner does not use a constant time string comparison
function. A remote attacker can perform a timing attack and gain access to sensitive functionality.
Install updates from vendor's website.
Vulnerable software versionsSymfony: 2.8.0 - 4.3.7
External linkshttp://symfony.com/blog/cve-2019-18887-use-constant-time-comparison-in-urisigner
http://github.com/symfony/symfony/commit/cccefe6a7f12e776df0665aeb77fe9294c285fbb
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Deserialization of Untrusted Data
EUVDB-ID: #VU22853
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-18889
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data in the AbstractAdapter and TagAwareAdapter instances within the Symfony Cache component. A remote attacker can pass specially crafted data to to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSymfony: 3.1.0 - 4.3.7
External linksQ & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) OS Command Injection
EUVDB-ID: #VU22852
Risk: Medium
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-18888
CWE-ID:
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists in MimeTypeGuesser within the Symfony HttpFoundation component when parsing data passed via the $path variable. A remote attacker can with ability to upload files can execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSymfony: 2.8.0 - 4.3.7
External linkshttp://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Improper control of interaction frequency
EUVDB-ID: #VU22930
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-18886
CWE-ID:
CWE-799 - Improper Control of Interaction Frequency
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information on the target system.
The vulnerability exists in the "Security/Http" component due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. A remote attacker can enumerate users on the target system.
Install updates from vendor's website.
Vulnerable software versionsSymfony: 4.2.0 - 4.3.7
External linkshttp://github.com/symfony/symfony/releases/tag/v4.3.8
http://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionality
http://symfony.com/blog/symfony-4-3-8-released
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Code Injection
EUVDB-ID: #VU22929
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2019-11325
CWE-ID:
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to some strings are not properly escaped when being dumped by the "VarExporter" component. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSymfony: 4.2.0 - 4.3.7
External linkshttp://github.com/symfony/symfony/releases/tag/v4.3.8
http://github.com/symfony/var-exporter/compare/d8bf442...57e00f3
http://symfony.com/blog/cve-2019-11325-fix-escaping-of-strings-in-varexporter
http://symfony.com/blog/symfony-4-3-8-released
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
