FEDORA-2015-9025Vendor advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html CVE-2015-4050
Nuclei
Symfony Incorrect Access Control
Record summary
CVE-2015-4050 has a selected CVSS score of 4.3; EIP currently links 1 Nuclei template.
Description
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
symfony/http-kernelBrowse Packagist / symfony/http-kernel | GitHub Advisory | 2.3.19 to < 2.3.29 · Fixed in 2.3.29 | affected |
| 2.5.4 to < 2.5.12 · Fixed in 2.5.12 | affected | ||
| 2.6.0 to < 2.6.8 · Fixed in 2.6.8 | affected | ||
| 2.4.9 to ≤ 2.4.10 | affected | ||
symfony/symfonyBrowse Packagist / symfony/symfony | GitHub Advisory | 2.3.19 to < 2.3.29 · Fixed in 2.3.29 | affected |
| 2.4.9 to ≤ 2.4.10 | affected | ||
| 2.5.4 to < 2.5.12 · Fixed in 2.5.12 | affected | ||
| 2.6.0 to < 2.6.8 · Fixed in 2.6.8 | affected |
Nuclei templates
1ProjectDiscoveryMEDIUMSymfony - Authentication BypassCVSS 4.3
Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the _controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /_fragment in the HttpKernel component.
Impact
Successful exploitation of this vulnerability could allow an attacker to bypass authentication and gain unauthorized access to the affected system.
Remediation
Apply the latest security patches or upgrade to a non-vulnerable version of Symfony.
WeaknessesCWE-284
AuthorsELSFA7110, meme-lord
Template tagscve2015cvesymfonyrcesensiolabsvuln
CVSS vector: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N
CPE: cpe:2.3:a:sensiolabs:symfony:2.3.19:*:*:*:*:*:*:*
Shodan: cpe:"cpe:2.3:a:sensiolabs:symfony"
https://symfony.com/blog/cve-2015-4050-esi-unauthorized-access http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access http://www.debian.org/security/2015/dsa-3276 https://nvd.nist.gov/vuln/detail/CVE-2015-4050 http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159513.html
Source: ProjectDiscovery
References
11FEDORA-2015-9034Vendor advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159603.html FEDORA-2015-9039Vendor advisory
http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159610.html symfony.comConfirmation
http://symfony.com/blog/cve-2015-4050-esi-unauthorized-access DSA-3276Vendor advisory
http://www.debian.org/security/2015/dsa-3276 74928vdb entry
http://www.securityfocus.com/bid/74928 github.com
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2015-4050.yaml github.com
https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2015-4050.yaml nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2015-4050 symfony.com
https://symfony.com/cve-2015-4050 web.archive.org
https://web.archive.org/web/20200228090443/http://www.securityfocus.com/bid/74928