CVE-2024-50341 Security::login does not take into account custom user_checker in symfony/security-bundle
Attackers can bypass custom user checks during programmatic login in Symfony, potentially gaining unauthorized access if custom checkers are configured.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50341?
CVE-2024-50341 is a low-severity authentication bypass vulnerability in symfony, published on 6 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Weakness: CWE-287
Which versions are affected by CVE-2024-50341?
12 open source packages ship an affected version, including symfony/security-bundle and symfony/symfony.
| Package | Affected | Fixed in |
|---|---|---|
symfony/security-bundle Packagist | From 6.2.0 | 6.4.10 |
symfony/security-bundle Packagist | From 6.2.0 | 6.4.10 |
symfony/security-bundle Packagist | From 7.0.0 | 7.0.10 |
symfony/security-bundle Packagist | From 7.0.0 | 7.0.10 |
symfony/security-bundle Packagist | From 7.1.0 | 7.1.3 |
symfony/security-bundle Packagist | From 7.1.0 | 7.1.3 |
6 more packages
symfony/symfony Packagist | From 6.2.0 | 6.4.10 |
symfony/symfony Packagist | From 6.2.0 | 6.4.10 |
symfony/symfony Packagist | From 7.0.0 | 7.0.10 |
symfony/symfony Packagist | From 7.0.0 | 7.0.10 |
symfony/symfony Packagist | From 7.1.0 | 7.1.3 |
symfony/symfony Packagist | From 7.1.0 | 7.1.3 |
How do I fix CVE-2024-50341?
Upgrade symfony/security-bundle to a fixed version for your release line: 6.4.10, 7.0.10 or 7.1.3.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-50341 being exploited?
There is no known exploitation of CVE-2024-50341 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-50341, GHSA-jxgr-3v7q-3w9v, UBUNTU-CVE-2024-50341.