Permissions, Privileges, and Access Controls in Symfony - CVE-2020-5275
Published: March 31, 2020
Vulnerability identifier: #VU26479
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-5275
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass implemented security measures.
The vulnerability exists due to a logical error when processing configured firewall rules in an unanimous configuration in Symfony. When a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy.
A remote attacker can bypass configured rules and gain unauthorized access to the web application.
Affected software
Symfony
Fedora
php-symfony4
Fedora
php-symfony4
How to mitigate CVE-2020-5275
Install updates from vendor's website.
Symfony - addressed in versions 4.4.7, 5.0.7
php-symfony4 - update to 4.4.7-1.fc32
php-symfony4 - update to 4.4.7-1.fc32