Vulnerabilities > CVE-2019-10910 - SQL Injection vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Command Line Execution through SQL Injection An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
- Object Relational Mapping Injection An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject his or her own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hibernate). While most of the time code generated by an ORM tool contains safe access methods that are immune to SQL injection, sometimes either due to some weakness in the generated code or due to the fact that the developer failed to use the generated access methods properly, SQL injection is still possible.
- SQL Injection through SOAP Parameter Tampering An attacker modifies the parameters of the SOAP message that is sent from the service consumer to the service provider to initiate a SQL injection attack. On the service provider side, the SOAP message is parsed and parameters are not properly validated before being used to access a database in a way that does not use parameter binding, thus enabling the attacker to control the structure of the executed SQL query. This pattern describes a SQL injection attack with the delivery mechanism being a SOAP message.
- Expanding Control over the Operating System from the Database An attacker is able to leverage access gained to the database to read / write data to the file system, compromise the operating system, create a tunnel for accessing the host machine, and use this access to potentially attack other machines on the same network as the database machine. Traditionally SQL injections attacks are viewed as a way to gain unauthorized read access to the data stored in the database, modify the data in the database, delete the data, etc. However, almost every data base management system (DBMS) system includes facilities that if compromised allow an attacker complete access to the file system, operating system, and full access to the host running the database. The attacker can then use this privileged access to launch subsequent attacks. These facilities include dropping into a command shell, creating user defined functions that can call system level libraries present on the host machine, stored procedures, etc.
- SQL Injection This attack exploits target software that constructs SQL statements based on user input. An attacker crafts input strings so that when the target software constructs SQL statements based on the input, the resulting SQL statement performs actions other than those the application intended. SQL Injection results from failure of the application to appropriately validate input. When specially crafted user-controlled input consisting of SQL syntax is used without proper validation as part of SQL queries, it is possible to glean information from the database in ways not envisaged during application design. Depending upon the database and the design of the application, it may also be possible to leverage injection to have the database execute system-related commands of the attackers' choice. SQL Injection enables an attacker to talk directly to the database, thus bypassing the application completely. Successful injection can cause information disclosure as well as ability to add or modify data in the database. In order to successfully inject SQL and retrieve information from a database, an attacker:
Nessus
NASL family Fedora Local Security Checks NASL id FEDORA_2019-8635280DE5.NASL description **Version 3.4.26** (2019-04-17) - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony) - bug #31142 Revert last seen 2020-06-01 modified 2020-06-02 plugin id 124514 published 2019-05-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124514 title Fedora 30 : php-symfony3 (2019-8635280de5) NASL family Fedora Local Security Checks NASL id FEDORA_2019-7EAF0BBE7C.NASL description - https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124686 published 2019-05-08 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124686 title Fedora 29 : drupal8 (2019-7eaf0bbe7c) NASL family Fedora Local Security Checks NASL id FEDORA_2019-A3CA65028C.NASL description **Version 3.4.26** (2019-04-17) - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony) - bug #31142 Revert last seen 2020-06-01 modified 2020-06-02 plugin id 124351 published 2019-04-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124351 title Fedora 29 : php-symfony3 (2019-a3ca65028c) NASL family Fedora Local Security Checks NASL id FEDORA_2019-0EF4149687.NASL description **Version 2.8.50** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124471 published 2019-05-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124471 title Fedora 30 : php-symfony (2019-0ef4149687) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-4441.NASL description Multiple vulnerabilities were discovered in the Symfony PHP framework which could lead to cache bypass, authentication bypass, information disclosure, open redirect, cross-site request forgery, deletion of arbitrary files, or arbitrary code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 124779 published 2019-05-13 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124779 title Debian DSA-4441-1 : symfony - security update NASL family Debian Local Security Checks NASL id DEBIAN_DLA-1778.NASL description Several security vulnerabilities have been discovered in symfony, a PHP web application framework. Numerous symfony components are affected: Framework Bundle, Dependency Injection, Security, HttpFoundation CVE-2019-10909 Validation messages were not escaped when using the form theme of the PHP templating engine which, when validation messages may contain user input, could result in an XSS. For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in- the-php-templating-engine CVE-2019-10910 Service IDs derived from unfiltered user input could result in the execution of any arbitrary code, resulting in possible remote code execution. For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10910-check-service-ids-ar e-valid CVE-2019-10911 This fixes situations where part of an expiry time in a cookie could be considered part of the username, or part of the username could be considered part of the expiry time. An attacker could modify the remember me cookie and authenticate as a different user. This attack is only possible if remember me functionality is enabled and the two users share a password hash or the password hashes (e.g. UserInterface::getPassword()) are null for all users (which is valid if passwords are checked by an external system, e.g. an SSO). For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remembe r-me-cookie-hash CVE-2019-10913 HTTP methods, from either the HTTP method itself or using the X-Http-Method-Override header were previously returned as the method in question without validation being done on the string, meaning that they could be used in dangerous contexts when left unescaped. For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-ove rrides For Debian 8 last seen 2020-06-01 modified 2020-06-02 plugin id 124657 published 2019-05-07 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124657 title Debian DLA-1778-1 : symfony security update NASL family Fedora Local Security Checks NASL id FEDORA_2019-32067D8B15.NASL description **Version 4.1.12** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [Cache][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124348 published 2019-04-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124348 title Fedora 29 : php-symfony4 (2019-32067d8b15) NASL family Fedora Local Security Checks NASL id FEDORA_2019-2A7F472198.NASL description **Version 3.4.26** (2019-04-17) - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony) - bug #31142 Revert last seen 2020-06-01 modified 2020-06-02 plugin id 124347 published 2019-04-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124347 title Fedora 28 : php-symfony3 (2019-2a7f472198) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_2BAD8B5D66FB11E9981578ACC0A3B880.NASL description Drupal Security Team reports : CVE-2019-10909: Escape validation messages in the PHP templating engine. CVE-2019-10910: Check service IDs are valid. CVE-2019-10911: Add a separator in the remember me cookie hash. jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extend(true, {}, ...). If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions. It last seen 2020-06-01 modified 2020-06-02 plugin id 124286 published 2019-04-25 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124286 title FreeBSD : drupal -- Drupal core - Moderately critical (2bad8b5d-66fb-11e9-9815-78acc0a3b880) NASL family Fedora Local Security Checks NASL id FEDORA_2019-F5D6A7CE74.NASL description **Version 4.2.7** (2019-04-17) - bug #31107 [Routing] fix trailing slash redirection with non-greedy trailing vars (nicolas-grekas) - bug #31108 [FrameworkBundle] decorate the ValidatorBuilder last seen 2020-06-01 modified 2020-06-02 plugin id 124556 published 2019-05-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124556 title Fedora 30 : php-symfony4 (2019-f5d6a7ce74) NASL family Fedora Local Security Checks NASL id FEDORA_2019-F8DB687840.NASL description **Version 2.8.50** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124352 published 2019-04-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124352 title Fedora 29 : php-symfony (2019-f8db687840) NASL family Fedora Local Security Checks NASL id FEDORA_2019-EBA8E44EE6.NASL description - https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124688 published 2019-05-08 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124688 title Fedora 30 : drupal8 (2019-eba8e44ee6) NASL family CGI abuses NASL id DRUPAL_8_5_15.NASL description According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.66, 8.5.x prior to 8.5.15, or 8.6.x prior to 8.6.15. It is, therefore, affected by multiple vulnerabilities. - The jQuery project released version 3.4.0, and as part of that, disclosed a security vulnerability that affects all prior versions. As described in their release notes: jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extend(true, {}, ...). If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions. It last seen 2020-06-01 modified 2020-06-02 plugin id 124176 published 2019-04-19 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124176 title Drupal 7.x < 7.66 / 8.5.x < 8.5.15 / 8.6.x < 8.6.15 Multiple Vulnerabilities (drupal-2019-04-17) NASL family Fedora Local Security Checks NASL id FEDORA_2019-1A3EDD7E8A.NASL description - https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124685 published 2019-05-08 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124685 title Fedora 28 : drupal8 (2019-1a3edd7e8a) NASL family Fedora Local Security Checks NASL id FEDORA_2019-3EE6A7ADF2.NASL description **Version 2.8.50** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124349 published 2019-04-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124349 title Fedora 28 : php-symfony (2019-3ee6a7adf2)
The Hacker News
id | THN:E4F045381B383C8262F29CAF29C6AFE4 |
last seen | 2019-04-17 |
modified | 2019-04-17 |
published | 2019-04-17 |
reporter | The Hacker News |
source | https://thehackernews.com/2019/04/drupal-security-update.html |
title | Drupal Releases Core CMS Updates to Patch Several Vulnerabilities |