VDB
Sign up
HIGH

GHSA-ph86-p8f6-f9r2

Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator

Quick fix

GHSA-ph86-p8f6-f9r2 — symfony/security-http: upgrade to the fixed version with the command below.

composer require symfony/security-http:^5.4.52

Details

### Description

`X509Authenticator` implements client-certificate (mTLS) authentication: the web server validates the client's certificate against a trusted CA, then passes the certificate's Subject DN (Distinguished Name: a string like `CN=Alice,O=Example,emailAddress=alice@example.com`) to Symfony via `$_SERVER['SSL_CLIENT_S_DN']`. Symfony extracts the user identifier from that string.

The extraction uses an **unanchored** regex that matches `emailAddress=` anywhere in the DN string: including inside the *value* of a different RDN (Relative Distinguished Name: one `key=value` component of the DN), such as `CN`. An attacker who can obtain a certificate from a trusted CA with a free-text `CN` can smuggle `emailAddress=victim@target` inside the CN value and be authenticated as the victim.

### Resolution

The `X509Authenticator` now uses a regex that anchors the match to an RDN boundary (start of string, or following a `,` / `/` separator).

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/ccb3f724c7ff55670a6fe3521c7bf1514cceb478) for branch 5.4.

### Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/symfony/security-http
Introduced in: 0Fixed in: 5.4.52
Fixcomposer require symfony/security-http:^5.4.52
Packagist/symfony/security-http
Introduced in: 6.0.0-BETA1Fixed in: 6.4.40
Fixcomposer require symfony/security-http:^6.4.40
Packagist/symfony/security-http
Introduced in: 7.0.0-BETA1Fixed in: 7.4.12
Fixcomposer require symfony/security-http:^7.4.12
Packagist/symfony/security-http
Introduced in: 8.0.0-BETA1Fixed in: 8.0.12
Fixcomposer require symfony/security-http:^8.0.12
Packagist/symfony/symfony
Introduced in: 0Fixed in: 5.4.52
Fixcomposer require symfony/symfony:^5.4.52
Packagist/symfony/symfony
Introduced in: 6.0.0-BETA1Fixed in: 6.4.40
Fixcomposer require symfony/symfony:^6.4.40
Packagist/symfony/symfony
Introduced in: 7.0.0-BETA1Fixed in: 7.4.12
Fixcomposer require symfony/symfony:^7.4.12
Packagist/symfony/symfony
Introduced in: 8.0.0-BETA1Fixed in: 8.0.12
Fixcomposer require symfony/symfony:^8.0.12

References