CVE-2021-41270
published 2021-11-24CVE-2021-41270: Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.35%
68.5th percentile
Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula injection. In Symfony 4.1, maintainers added the opt-in `csv_escape_formulas` option in the `CsvEncoder`, to prefix all cells starting with `=`, `+`, `-` or `@` with a tab `\t`. Since then, OWASP added 2 chars in that list: Tab (0x09) and Carriage return (0x0D). This makes the previous prefix char (Tab `\t`) part of the vulnerable characters, and OWASP suggests using the single quote `'` for prefixing the value. Starting with versions 4.4.34 and 5.3.12, Symfony now follows the OWASP recommendations and uses the single quote `'` to prefix formulas and add the prefix to cells starting by `\t`, `\r` as well as `=`, `+`, `-` and `@`.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | symfony | < symfony 4.4.19+dfsg-3 (bookworm) | symfony 4.4.19+dfsg-3 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| sensiolabs | symfony | >= 4.1.0 < 4.4.35 | 4.4.35 |
| sensiolabs | symfony | >= 5.0.0 < 5.3.12 | 5.3.12 |
| symfony | serializer | >= 4.1.0 < 4.4.35 | 4.4.35 |
| symfony | serializer | >= 5.0.0 < 5.3.12 | 5.3.12 |
| symfony | symfony | — | — |
| symfony | symfony | — | — |
| symfony | symfony | >= 0 < 4.4.19+dfsg-2+deb11u1 | 4.4.19+dfsg-2+deb11u1 |
| symfony | symfony | >= 0 < 4.4.19+dfsg-3 | 4.4.19+dfsg-3 |
| symfony | symfony | >= 0 < 4.4.19+dfsg-3 | 4.4.19+dfsg-3 |
| symfony | symfony | >= 0 < 4.4.19+dfsg-3 | 4.4.19+dfsg-3 |
| symfony | symfony | >= 0 < 3.4.6+dfsg-1ubuntu0.1+esm2 | 3.4.6+dfsg-1ubuntu0.1+esm2 |
| symfony | symfony | >= 0 < 4.3.8+dfsg-1ubuntu1+esm1 | 4.3.8+dfsg-1ubuntu1+esm1 |
| symfony | symfony | >= 4.1.0 < 4.4.35 | 4.4.35 |
| symfony | symfony | >= 5.0.0 < 5.3.12 | 5.3.12 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
osv6.5MEDIUM
vendor_debian6.5MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Symfony vulnerabilities
vendor_ubuntu·2022-08-24·CVSS 5.3
CVE-2021-21424 [MEDIUM] Symfony vulnerabilities
Title: Symfony vulnerabilities
Summary: Several security issues were fixed in Symfony.
James Isaac and Mathias Brodala discovered that Symfony incorrectly handled
switch users functionality. An attacker could possibly use this issue to
enumerate users. (CVE-2021-21424)
It was discovered that Symfony incorrectly handled certain specially crafted
CSV files. An attacker could possibly use this issue to execute arbitrary
code. This issue only affected Ubuntu 20.04 ESM. (CVE-2021-41270)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2021-41270: symfony - Symfony/Serializer handles serializing and deserializing data structures for Sym...
vendor_debian·2021·CVSS 6.5
CVE-2021-41270 [MEDIUM] CVE-2021-41270: symfony - Symfony/Serializer handles serializing and deserializing data structures for Sym...
Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula injection. In Symfony 4.1, maintainers added the opt-in `csv_escape_formulas` option in the `CsvEncoder`, to prefix all cells starting with `=`, `+`, `-` or `@` with a tab `\t`. Since then, OWASP added 2 chars in that list: Tab (0x09) and Carriage return (0x0D). This makes the previous prefix char (Tab `\t`) part of the vulnerable characters, and OWASP suggests using the single quote `'` for prefixing the value. Starting with versions 4.4.34 and 5.3.12, Symfony now follows the OWASP recommendation
OSV
symfony vulnerabilities
osv·2022-08-24·CVSS 5.3
CVE-2021-21424 [MEDIUM] symfony vulnerabilities
symfony vulnerabilities
James Isaac and Mathias Brodala discovered that Symfony incorrectly handled
switch users functionality. An attacker could possibly use this issue to
enumerate users. (CVE-2021-21424)
It was discovered that Symfony incorrectly handled certain specially crafted
CSV files. An attacker could possibly use this issue to execute arbitrary
code. This issue only affected Ubuntu 20.04 ESM. (CVE-2021-41270)
OSV
CVE-2021-41270: Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of re
osv·2021-11-24·CVSS 6.5
CVE-2021-41270 [MEDIUM] CVE-2021-41270: Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of re
Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula injection. In Symfony 4.1, maintainers added the opt-in `csv_escape_formulas` option in the `CsvEncoder`, to prefix all cells starting with `=`, `+`, `-` or `@` with a tab `\t`. Since then, OWASP added 2 chars in that list: Tab (0x09) and Carriage return (0x0D). This makes the previous prefix char (Tab `\t`) part of the vulnerable characters, and OWASP suggests using the single quote `'` for prefixing the value. Starting with versions 4.4.34 and 5.3.12, Symfony now follows the OWASP recommendation
OSV
CSV Injection in symfony/serializer
osv·2021-11-24
CVE-2021-41270 [MEDIUM] CSV Injection in symfony/serializer
CSV Injection in symfony/serializer
Description
CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any cell starting with `=` is interpreted by the software as a formula and could be abused by an attacker.
In Symfony 4.1, we've added the opt-in `csv_escape_formulas` option in `CsvEncoder`, to prefix all cells starting by `=`, `+`, `-` or `@` by a tab `\t`.
Since then, OWASP added 2 chars in that list:
- Tab (0x09)
- Carriage return (0x0D)
This makes our previous prefix char (Tab `\t`) part of the vulnerable characters, and [OWASP suggests](https://owasp.org/www-community/attacks/CSV_Injection) using the single quote `'` for prefixing the value.
Resolution
Symfony now follows the OWASP r
GHSA
CSV Injection in symfony/serializer
ghsa·2021-11-24
CVE-2021-41270 [MEDIUM] CWE-1236 CSV Injection in symfony/serializer
CSV Injection in symfony/serializer
Description
CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any cell starting with `=` is interpreted by the software as a formula and could be abused by an attacker.
In Symfony 4.1, we've added the opt-in `csv_escape_formulas` option in `CsvEncoder`, to prefix all cells starting by `=`, `+`, `-` or `@` by a tab `\t`.
Since then, OWASP added 2 chars in that list:
- Tab (0x09)
- Carriage return (0x0D)
This makes our previous prefix char (Tab `\t`) part of the vulnerable characters, and [OWASP suggests](https://owasp.org/www-community/attacks/CSV_Injection) using the single quote `'` for prefixing the value.
Resolution
Symfony now follows the OWASP r
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8https://github.com/symfony/symfony/pull/44243https://github.com/symfony/symfony/releases/tag/v5.3.12https://github.com/symfony/symfony/security/advisories/GHSA-2xhg-w2g5-w95xhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BPT4SF6SIXFMZARDWED5T32J7JEH3EP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QSREFD2TJT5LWKM6S4MD3W26NQQ5WJUP/https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8https://github.com/symfony/symfony/pull/44243https://github.com/symfony/symfony/releases/tag/v5.3.12https://github.com/symfony/symfony/security/advisories/GHSA-2xhg-w2g5-w95xhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3BPT4SF6SIXFMZARDWED5T32J7JEH3EP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QSREFD2TJT5LWKM6S4MD3W26NQQ5WJUP/
2021-11-24
Published