Detections
Analytics

Symfony Secret Fragments Remote Code Execution

critical Web App Scanning Plugin ID 112685

Language:

Synopsis

Symfony Secret Fragments Remote Code Execution

Description

The Symfony framework or Symfony based projects uses a secret that is used for its cryptographic operations such as the creation of cookies or anti-CSRF tokens.

A feature (not enabled by default) allows to execute arbitrary PHP code via a GET parameter.

If this secret is exposed, through a vulnerability or due to the use of a weak/default secret, then an attacker will be able to abuse this feature to forge a URL with arbitrary PHP code, allowing remote code execution on the machine.

Solution

It is necessary to make sure that the APP_SECRET variable of your Symfony project has no default value, that it is random and sufficiently robust.

See Also

https://portswigger.net/daily-swig/symfony-based-websites-open-to-rce-attack-research-finds

https://www.ambionics.io/blog/symfony-secret-fragment

Plugin Details

Severity: Critical

ID: 112685

Type: remote

Published: 2/3/2021

Updated: 9/7/2021

Scan Template: api, basic, full, pci, scan

Risk Information

VPR

Risk Factor: High

Score: 7.5

CVSS v2

Risk Factor: High

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Critical

Base Score: 9

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CVSS Score Source: Tenable

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 10/19/2020

Reference Information