Fluid Attacks Database

Description

Symfony CSRF Vulnerability An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	symfony/symfony	>=2.7.0 <2.7.38 \|\| >=2.8.0 <2.8.31 \|\| >=3.0.0 <3.2.14 \|\| >=3.3.0 <3.3.13	2.7.38, 2.8.31, 3.2.14, 3.3.13
packagist	symfony/security	>=2.7.0 <2.7.38 \|\| >=2.8.0 <2.8.31 \|\| >=3.0.0 <3.2.14 \|\| >=3.3.0 <3.3.13	2.7.38, 2.8.31, 3.2.14, 3.3.13
packagist	symfony/security-csrf	>=2.7.0 <2.7.38 \|\| >=2.8.0 <2.8.31 \|\| >=3.0.0 <3.2.14 \|\| >=3.3.0 <3.3.13	2.7.38, 2.8.31, 3.2.14, 3.3.13
debian 13	symfony	>=0 <3.4.0+dfsg-1	3.4.0+dfsg-1
debian 11	symfony	>=0 <3.4.0+dfsg-1	3.4.0+dfsg-1
debian 12	symfony	>=0 <3.4.0+dfsg-1	3.4.0+dfsg-1
debian 14	symfony	>=0 <3.4.0+dfsg-1	3.4.0+dfsg-1

Aliases

1. CVE-2017-166532. NVD-2017-166533. OSV-2017-166534. OSV-DEBIAN-2017-166535. GCVE-2017-166536. SECURITY-TRACKER-CVE-2017-16653

References

1. https://github.com/symfony/symfony/pull/249922. https://github.com/symfony/symfony/commit/b4dbdd7cd8732483d585eacff3428c16b07ad15e3. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-csrf/CVE-2017-16653.yaml4. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2017-16653.yaml5. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2017-16653.yaml6. https://symfony.com/blog/cve-2017-16653-csrf-protection-does-not-use-different-tokens-for-http-and-https7. https://symfony.com/cve-2017-166538. https://www.debian.org/security/2018/dsa-4262