CVE-2020-5275 Firewall configured with unanimous strategy was not actually unanimous in symfony/security-http
Attackers can bypass access controls in Symfony applications using the unanimous firewall strategy due to premature access decision granting.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-5275?
CVE-2020-5275 is a high-severity authentication bypass vulnerability in Sensiolabs Symfony, published on 30 Mar 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In symfony/security-http before versions 4.4.7 and 5.0.7, when a `Firewall` checks access control rule, it iterate overs each rule's attributes and stops as soon as the accessDecisionManager decides to grant access on the attribute, preventing the check of next attributes that should have been take into account in an unanimous strategy. The accessDecisionManager is now called with all attributes at once, allowing the unanimous strategy being applied on each attribute. This issue is patched in versions 4.4.7 and 5.0.7.
Which versions are affected by CVE-2020-5275?
13 open source packages ship an affected version, including symfony/security, symfony and symfony/security-http. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
symfony/security Packagist | From 4.4.0 | 4.4.7 |
symfony/security Packagist | From 4.4.0 | 4.4.7 |
symfony/security Packagist | From 5.0.0 | 5.0.7 |
symfony/security Packagist | From 5.0.0 | 5.0.7 |
symfony Bitnami | From 4.4.0 | 4.4.7, 5.0.7 |
symfony/security-http Packagist | From 4.4.0 | 4.4.7 |
7 more packages
symfony/security-http Packagist | From 4.4.0 | 4.4.7 |
symfony/security-http Packagist | From 5.0.0 | 5.0.7 |
symfony/security-http Packagist | From 5.0.0 | 5.0.7 |
symfony/symfony Packagist | From 4.4.0 | 4.4.7 |
symfony/symfony Packagist | From 4.4.0 | 4.4.7 |
symfony/symfony Packagist | From 5.0.0 | 5.0.7 |
symfony/symfony Packagist | From 5.0.0 | 5.0.7 |
Products include Sensiolabs Symfony.
How do I fix CVE-2020-5275?
Upgrade symfony/security to a fixed version for your release line: 4.4.7 or 5.0.7.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-5275 being exploited?
There is no known exploitation of CVE-2020-5275 in the wild and no public exploit code.
Other vulnerabilities in Sensiolabs Symfony
Sources
Also known as BIT-symfony-2020-5275, DEBIAN-CVE-2020-5275, GHSA-g4m9-5hpf-hx72.