CVE-2018-11407 Symfony Authentication Bypass
Remote attackers can bypass authentication in Symfony's Ldap component by logging in with a null password and valid username.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-11407?
CVE-2018-11407 is a critical authentication bypass vulnerability in Sensiolabs Symfony, published on 13 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the Ldap component in Symfony 2.8.x before 2.8.37, 3.3.x before 3.3.17, 3.4.x before 3.4.7, and 4.0.x before 4.0.7. It allows remote attackers to bypass authentication by logging in with a "null" password and valid username, which triggers an unauthenticated bind. NOTE: this issue exists because of an incomplete fix for CVE-2016-2403.
Weakness: CWE-287
Which versions are affected by CVE-2018-11407?
24 open source packages ship an affected version, including symfony/security, symfony/security-core and symfony/symfony. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
symfony/security Packagist | From 2.8.0 | 2.8.37 |
symfony/security Packagist | From 2.8.0 | 2.8.37 |
symfony/security Packagist | From 3.0.0 | 3.3.17 |
symfony/security Packagist | From 3.0.0 | 3.3.17 |
symfony/security Packagist | From 3.4.0 | 3.4.7 |
symfony/security Packagist | From 3.4.0 | 3.4.7 |
18 more packages
symfony/security Packagist | From 4.0.0 | 4.0.7 |
symfony/security Packagist | From 4.0.0 | 4.0.7 |
symfony/security-core Packagist | From 2.8.0 | 2.8.37 |
symfony/security-core Packagist | From 2.8.0 | 2.8.37 |
symfony/security-core Packagist | From 3.0.0 | 3.3.17 |
symfony/security-core Packagist | From 3.0.0 | 3.3.17 |
symfony/security-core Packagist | From 3.4.0 | 3.4.7 |
symfony/security-core Packagist | From 3.4.0 | 3.4.7 |
symfony/security-core Packagist | From 4.0.0 | 4.0.7 |
symfony/security-core Packagist | From 4.0.0 | 4.0.7 |
symfony/symfony Packagist | From 2.8.0 | 2.8.37 |
symfony/symfony Packagist | From 2.8.0 | 2.8.37 |
symfony/symfony Packagist | From 3.0.0 | 3.3.17 |
symfony/symfony Packagist | From 3.0.0 | 3.3.17 |
symfony/symfony Packagist | From 3.4.0 | 3.4.7 |
symfony/symfony Packagist | From 3.4.0 | 3.4.7 |
symfony/symfony Packagist | From 4.0.0 | 4.0.7 |
symfony/symfony Packagist | From 4.0.0 | 4.0.7 |
Products include Sensiolabs Symfony.
How do I fix CVE-2018-11407?
Upgrade symfony/security to a fixed version for your release line: 2.8.37, 3.3.17, 3.4.7 or 4.0.7.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-11407 being exploited?
There is no known exploitation of CVE-2018-11407 in the wild and no public exploit code.
Other vulnerabilities in Sensiolabs Symfony
- CVE-2019-11325 Improper Input Validation in Symfony
- CVE-2017-11365 Symfony Incorrect Access Control
- CVE-2019-10913 Invalid HTTP method overrides allow possible XSS or other attacks in Symfony
- CVE-2016-2403 Symfony Authentication Bypass
- CVE-2026-45063 Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator
Sources
Also known as DEBIAN-CVE-2018-11407, GHSA-35c5-28pg-2qg4, UBUNTU-CVE-2018-11407, USN-4836-1.