Vulnerabilities > CVE-2017-16652 - Open Redirect vulnerability in multiple products
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
NONE Summary
An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. DefaultAuthenticationSuccessHandler or DefaultAuthenticationFailureHandler takes the content of the _target_path parameter and generates a redirect response, but no check is performed on the path, which could be an absolute URL to an external domain. This Open redirect vulnerability can be exploited for example to mount effective phishing attacks.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Fake the Source of Data An adversary provides data under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or it might be an attempt by the adversary to assume the rights granted to another identity. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.
Nessus
NASL family Debian Local Security Checks NASL id DEBIAN_DLA-1707.NASL description Several security vulnerabilities have been discovered in symfony, a PHP web application framework. Numerous symfony components are affected: Security, bundle readers, session handling, SecurityBundle, HttpFoundation, Form, and Security\Http. The corresponding upstream advisories contain further details : [CVE-2017-16652] https://symfony.com/blog/cve-2017-16652-open-redirect-vulnerability-on -security-handlers [CVE-2017-16654] https://symfony.com/blog/cve-2017-16654-intl-bundle-readers-breaking-o ut-of-paths [CVE-2018-11385] https://symfony.com/blog/cve-2018-11385-session-fixation-issue-for-gua rd-authentication [CVE-2018-11408] https://symfony.com/blog/cve-2018-11408-open-redirect-vulnerability-on -security-handlers [CVE-2018-14773] https://symfony.com/blog/cve-2018-14773-remove-support-for-legacy-and- risky-http-headers [CVE-2018-19789] https://symfony.com/blog/cve-2018-19789-disclosure-of-uploaded-files-f ull-path [CVE-2018-19790] https://symfony.com/blog/cve-2018-19790-open-redirect-vulnerability-wh en-using-security-http For Debian 8 last seen 2020-06-01 modified 2020-06-02 plugin id 122721 published 2019-03-11 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/122721 title Debian DLA-1707-1 : symfony security update NASL family Fedora Local Security Checks NASL id FEDORA_2018-C8DDC44BBB.NASL description ## 3.3.17 (2018-05-25) - security #cve-2018-11407 [Ldap] cast to string when checking empty passwords - security #cve-2018-11408 [SecurityBundle] Fail if security.http_utils cannot be configured - security #cve-2018-11406 clear CSRF tokens when the user is logged out - security #cve-2018-11385 migrating session for UsernamePasswordJsonAuthenticationListener - security #cve-2018-11386 [HttpFoundation] Break infinite loop in PdoSessionHandler when MySQL is in loose mode Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2018-07-09 plugin id 110952 published 2018-07-09 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110952 title Fedora 27 : php-symfony3 (2018-c8ddc44bbb) NASL family Fedora Local Security Checks NASL id FEDORA_2018-2BDFC9DC67.NASL description ## 2.8.42 (2018-06-25) - bug #27669 [Filesystem] fix file lock on SunOS (fritzmg) - bug #27309 Fix surrogate not using original request (Toflar) - bug #27630 [Validator][Form] Remove BOM in some xlf files (gautierderuette) - bug #27591 [VarDumper] Fix dumping ArrayObject and ArrayIterator instances (nicolas-grekas) - bug #27581 Fix bad method call with guard authentication + session migration (weaverryan) - bug #27452 Avoid migration on stateless firewalls (weaverryan) - bug #27514 [Debug] Pass previous exception to FatalErrorException (pmontoya) - bug #26973 [HttpKernel] Set first trusted proxy as REMOTE_ADDR in InlineFragmentRenderer. (kmadejski) - bug #27303 [Process] Consider last seen 2020-06-05 modified 2018-07-09 plugin id 110949 published 2018-07-09 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110949 title Fedora 27 : php-symfony (2018-2bdfc9dc67)