Permissions, Privileges, and Access Controls in Symfony - CVE-2020-5275

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass implemented security measures.

The vulnerability exists due to a logical error when processing configured firewall rules in an unanimous configuration in Symfony. When a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy.

A remote attacker can bypass configured rules and gain unauthorized access to the web application.

How to mitigate CVE-2020-5275

Sources

• https://github.com/symfony/symfony/commit/c935e4a3fba6cc2ab463a6ca382858068d63cebf
• https://github.com/symfony/symfony/security/advisories/GHSA-g4m9-5hpf-hx72
• https://github.com/symfony/symfony/releases/tag/v5.0.7
• https://github.com/symfony/symfony/releases/tag/v4.4.7