CVE-2021-21424

MEDIUM

Symfony 3.4.0-3.4.48 - Unauthorized User Enumeration via Switch User Functionality

Title source: llm

Exploitation Summary

EIP tracks 2 public exploits for CVE-2021-21424. PoCs published by moften.

AI-analyzed exploit summary This repository contains a Python-based scanner for detecting multiple vulnerabilities in Symfony applications, including CRLF injection, Host Header Injection, and exposed Symfony Profiler endpoints. It performs safe, non-invasive checks without attempting exploitation.

Description

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.

Exploits (2)

nomisec SCANNER

by moften · poc

https://github.com/moften/Symfony-CVE-Scanner-PoC-

View Code ZIP pw:eip

This repository contains a Python-based scanner for detecting multiple vulnerabilities in Symfony applications, including CRLF injection, Host Header Injection, and exposed Symfony Profiler endpoints. It performs safe, non-invasive checks without attempting exploitation.

Classification

Scanner 95%

Attack Type

Info Leak

Complexity

Moderate

Reliability

Reliable

Target: Symfony (various versions)

No auth needed

Prerequisites: Network access to the target Symfony application

MITRE ATT&CK

T1189 - Drive-by Compromise T1082 - System Information Discovery

devstral-2 · analyzed Feb 16, 2026 Full analysis →

nomisec WORKING POC

by moften · poc

https://github.com/moften/CVE-2021-21424

View Code ZIP pw:eip

The repository contains a functional Python script that exploits CVE-2021-21424 by enumerating Symfony WebProfiler tokens and dumping sensitive information exposed via the profiler interface. The exploit leverages directory traversal to access internal server paths and environment variables.

Classification

Working Poc 95%