Fluid Attacks Database

Description

Symfony CSRF Token Fixation An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. By default, a user's session is invalidated when the user is logged out. This behavior can be disabled through the invalidate_session option. In this case, CSRF tokens were not erased during logout which allowed for CSRF token fixation.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	symfony/symfony	>=2.7.0 <2.7.48 \|\| >=2.8.0 <2.8.41 \|\| >=3.0.0 <3.3.17 \|\| >=3.4.0 <3.4.11 \|\| >=4.0.0 <4.0.11	2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
packagist	symfony/security	>=2.7.0 <2.7.48 \|\| >=2.8.0 <2.8.41 \|\| >=3.0.0 <3.3.17 \|\| >=3.4.0 <3.4.11 \|\| >=4.0.0 <4.0.11	2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
packagist	symfony/security-http	>=2.7.0 <2.7.48 \|\| >=2.8.0 <2.8.41 \|\| >=3.0.0 <3.3.17 \|\| >=3.4.0 <3.4.11 \|\| >=4.0.0 <4.0.11	2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
packagist	symfony/security-bundle	>=2.7.0 <2.7.48 \|\| >=2.8.0 <2.8.41 \|\| >=3.0.0 <3.3.17 \|\| >=3.4.0 <3.4.11 \|\| >=4.0.0 <4.0.11	2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11
debian 12	symfony	>=0 <3.4.12+dfsg-1	3.4.12+dfsg-1
debian 11	symfony	>=0 <3.4.12+dfsg-1	3.4.12+dfsg-1
debian 13	symfony	>=0 <3.4.12+dfsg-1	3.4.12+dfsg-1
packagist	symfony/security-csrf	>=2.7.0 <2.7.48 \|\| >=2.8.0 <2.8.41 \|\| >=3.0.0 <3.4.11 \|\| >=4.0.0 <4.0.11	2.7.48, 2.8.41, 3.4.11, 4.0.11
debian 14	symfony	>=0 <3.4.12+dfsg-1	3.4.12+dfsg-1

Aliases

1. CVE-2018-114062. NVD-2018-114063. OSV-2018-114064. OSV-DEBIAN-2018-114065. GCVE-2018-114066. SECURITY-TRACKER-CVE-2018-114067. SYMFONY-cve-2018-11406

References

1. https://github.com/symfony/symfony/commit/319e1bdd43979d9c1559497de8d69adea28ab8d12. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-bundle/CVE-2018-11406.yaml3. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2018-11406.yaml4. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security/CVE-2018-11406.yaml5. https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2018-11406.yaml6. https://lists.fedoraproject.org/archives/list/[email protected]/message/G4XNBMFW33H47O5TZGA7JYCVLDBCXAJV7. https://lists.fedoraproject.org/archives/list/[email protected]/message/UBQK7JDXIELADIPGZIOUCZKMAJM5LSBW8. https://lists.fedoraproject.org/archives/list/[email protected]/message/WU5N2TZFNGXDGMXMPP7LZCWTFLENF6WH9. https://symfony.com/blog/cve-2018-11406-csrf-token-fixation10. https://symfony.com/cve-2018-1140611. https://www.debian.org/security/2018/dsa-4262