CVE-2023-46734 Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters
Attackers can inject malicious scripts via Twig filters in Symfony, potentially leading to code execution or session hijacking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-46734?
CVE-2023-46734 is a medium-severity cross-site scripting vulnerability in Debian Debian Linux, published on 10 Nov 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to versions 4.4.51, 5.4.31, and 6.3.8, some Twig filters in CodeExtension use `is_safe=html` but don't actually ensure their input is safe. As of versions 4.4.51, 5.4.31, and 6.3.8, Symfony now escapes the output of the affected filters.
Weakness: CWE-79
Which versions are affected by CVE-2023-46734?
13 open source packages ship an affected version, including symfony/symfony, symfony and symfony/twig-bridge. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
symfony/symfony Packagist | From 2.0.0 | 4.4.51 |
symfony/symfony Packagist | From 2.0.0 | 4.4.51 |
symfony/symfony Packagist | From 5.0.0 | 5.4.31 |
symfony/symfony Packagist | From 5.0.0 | 5.4.31 |
symfony/symfony Packagist | From 6.0.0 | 6.3.8 |
symfony/symfony Packagist | From 6.0.0 | 6.3.8 |
7 more packages
symfony Bitnami | From 2.0.0 | 4.4.51, 5.4.31, 6.3.8 |
symfony/twig-bridge Packagist | From 2.0.0 | 4.4.51 |
symfony/twig-bridge Packagist | From 2.0.0 | 4.4.51 |
symfony/twig-bridge Packagist | From 5.0.0 | 5.4.31 |
symfony/twig-bridge Packagist | From 5.0.0 | 5.4.31 |
symfony/twig-bridge Packagist | From 6.0.0 | 6.3.8 |
symfony/twig-bridge Packagist | From 6.0.0 | 6.3.8 |
Products include Debian Debian Linux, Sensiolabs Symfony, Symfony Twig-Bridge.
How do I fix CVE-2023-46734?
Upgrade symfony/symfony to a fixed version for your release line: 4.4.51, 5.4.31 or 6.3.8.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-46734 being exploited?
There is no known exploitation of CVE-2023-46734 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-symfony-2023-46734, DEBIAN-CVE-2023-46734, DLA-3664-1, GHSA-q847-2q57-wmr3, UBUNTU-CVE-2023-46734.