CVE-2021-21424
published 2021-05-13CVE-2021-21424: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
1.71%
74.9th percentile
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | symfony | < symfony 4.4.19+dfsg-2 (bookworm) | symfony 4.4.19+dfsg-2 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| lexik | jwt-authentication-bundle | >= 2.0.0 < 2.10.7 | 2.10.7 |
| lexik | jwt-authentication-bundle | >= 2.11.0 < 2.11.3 | 2.11.3 |
| sensiolabs | symfony | >= 2.8.0 < 3.4.48 | 3.4.48 |
| sensiolabs | symfony | >= 4.0.0 < 4.4.23 | 4.4.23 |
| sensiolabs | symfony | >= 5.0.0 < 5.2.8 | 5.2.8 |
| symfony | maker-bundle | >= 1.27.0 < 1.29.2 | 1.29.2 |
| symfony | maker-bundle | >= 1.30.0 < 1.31.1 | 1.31.1 |
| symfony | security | >= 2.8.0 < 3.4.49 | 3.4.49 |
| symfony | security | >= 4.0.0 < 4.4.24 | 4.4.24 |
| symfony | security | >= 5.0.0 < 5.2.8 | 5.2.8 |
| symfony | security-core | >= 2.8.0 < 3.4.48 | 3.4.48 |
| symfony | security-core | >= 4.0.0 < 4.4.23 | 4.4.23 |
| symfony | security-core | >= 5.0.0 < 5.2.8 | 5.2.8 |
| symfony | security-guard | >= 2.8.0 < 3.4.48 | 3.4.48 |
| symfony | security-guard | >= 4.0.0 < 4.4.23 | 4.4.23 |
| symfony | security-guard | >= 5.0.0 < 5.2.8 | 5.2.8 |
| symfony | security-http | >= 5.1.0 < 5.2.8 | 5.2.8 |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | >= 0 < 4.4.19+dfsg-2 | 4.4.19+dfsg-2 |
| symfony | symfony | >= 0 < 4.4.19+dfsg-2 | 4.4.19+dfsg-2 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
symfony vulnerabilities
osv·2022-08-24·CVSS 5.3
CVE-2021-21424 [MEDIUM] symfony vulnerabilities
symfony vulnerabilities
James Isaac and Mathias Brodala discovered that Symfony incorrectly handled
switch users functionality. An attacker could possibly use this issue to
enumerate users. (CVE-2021-21424)
It was discovered that Symfony incorrectly handled certain specially crafted
CSV files. An attacker could possibly use this issue to execute arbitrary
code. This issue only affected Ubuntu 20.04 ESM. (CVE-2021-41270)
GHSA
Prevent user enumeration using Guard or the new Authenticator-based Security
ghsa·2021-05-13
CVE-2021-21424 [MEDIUM] CWE-200 Prevent user enumeration using Guard or the new Authenticator-based Security
Prevent user enumeration using Guard or the new Authenticator-based Security
Description
The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user.
Resolution
We now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist.
The patch for this issue is available [here](https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011) for branch 3.4.
Credits
I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Ch
OSV
Prevent user enumeration using Guard or the new Authenticator-based Security
osv·2021-05-13
CVE-2021-21424 [MEDIUM] Prevent user enumeration using Guard or the new Authenticator-based Security
Prevent user enumeration using Guard or the new Authenticator-based Security
Description
The ability to enumerate users was possible without relevant permissions due to different exception messages depending on whether the user existed or not. It was also possible to enumerate users by using a timing attack, by comparing time elapsed when authenticating an existing user and authenticating a non-existing user.
Resolution
We now ensure that 403s are returned whether the user exists or not if the password is invalid or if the user does not exist.
The patch for this issue is available [here](https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011) for branch 3.4.
Credits
I would like to thank James Isaac and Mathias Brodala for reporting the issue and Robin Ch
OSV
CVE-2021-21424: Symfony is a PHP framework for web and console applications and a set of reusable PHP components
osv·2021-05-13·CVSS 5.3
CVE-2021-21424 [MEDIUM] CVE-2021-21424: Symfony is a PHP framework for web and console applications and a set of reusable PHP components
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
Ubuntu
Symfony vulnerabilities
vendor_ubuntu·2022-08-24·CVSS 5.3
CVE-2021-21424 [MEDIUM] Symfony vulnerabilities
Title: Symfony vulnerabilities
Summary: Several security issues were fixed in Symfony.
James Isaac and Mathias Brodala discovered that Symfony incorrectly handled
switch users functionality. An attacker could possibly use this issue to
enumerate users. (CVE-2021-21424)
It was discovered that Symfony incorrectly handled certain specially crafted
CSV files. An attacker could possibly use this issue to execute arbitrary
code. This issue only affected Ubuntu 20.04 ESM. (CVE-2021-41270)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2021-21424: symfony - Symfony is a PHP framework for web and console applications and a set of reusabl...
vendor_debian·2021·CVSS 5.3
CVE-2021-21424 [MEDIUM] CVE-2021-21424: symfony - Symfony is a PHP framework for web and console applications and a set of reusabl...
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possible without relevant permissions due to different handling depending on whether the user existed or not when attempting to use the switch users functionality. We now ensure that 403s are returned whether the user exists or not if a user cannot switch to a user or if the user does not exist. The patch for this issue is available for branch 3.4.
Scope: local
bookworm: resolved (fixed in 4.4.19+dfsg-2)
bullseye: resolved (fixed in 4.4.19+dfsg-2)
forky: resolved (fixed in 4.4.19+dfsg-2)
sid: resolved (fixed in 4.4.19+dfsg-2)
trixie: resolved (fixed in 4.4.19+dfsg-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011https://github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68https://lists.debian.org/debian-lts-announce/2023/07/msg00014.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KENRNLB3FYXYGDWRBH2PDBOZZKOD7VY4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH7TMM5CHQYBFFGXWRPJDPB3SKCZXI2M/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UC7BND775DVZDQT3RMGD2HVB2PKLJDJW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRUS2H2SSOQWNLBD35SKIWIDQEMV2PD3/https://github.com/symfony/symfony/commit/2a581d22cc621b33d5464ed65c4bc2057f72f011https://github.com/symfony/symfony/security/advisories/GHSA-5pv8-ppvj-4h68https://lists.debian.org/debian-lts-announce/2023/07/msg00014.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KENRNLB3FYXYGDWRBH2PDBOZZKOD7VY4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RH7TMM5CHQYBFFGXWRPJDPB3SKCZXI2M/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UC7BND775DVZDQT3RMGD2HVB2PKLJDJW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VRUS2H2SSOQWNLBD35SKIWIDQEMV2PD3/
2021-05-13
Published