Vulnerabilities > CVE-2019-10910 - SQL Injection vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
sensiolabs
drupal
CWE-89
nessus

Summary

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.

Vulnerable Configurations

Part Description Count
Application
Sensiolabs
163
Application
Drupal
39

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
  • Object Relational Mapping Injection
    An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject his or her own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hibernate). While most of the time code generated by an ORM tool contains safe access methods that are immune to SQL injection, sometimes either due to some weakness in the generated code or due to the fact that the developer failed to use the generated access methods properly, SQL injection is still possible.
  • SQL Injection through SOAP Parameter Tampering
    An attacker modifies the parameters of the SOAP message that is sent from the service consumer to the service provider to initiate a SQL injection attack. On the service provider side, the SOAP message is parsed and parameters are not properly validated before being used to access a database in a way that does not use parameter binding, thus enabling the attacker to control the structure of the executed SQL query. This pattern describes a SQL injection attack with the delivery mechanism being a SOAP message.
  • Expanding Control over the Operating System from the Database
    An attacker is able to leverage access gained to the database to read / write data to the file system, compromise the operating system, create a tunnel for accessing the host machine, and use this access to potentially attack other machines on the same network as the database machine. Traditionally SQL injections attacks are viewed as a way to gain unauthorized read access to the data stored in the database, modify the data in the database, delete the data, etc. However, almost every data base management system (DBMS) system includes facilities that if compromised allow an attacker complete access to the file system, operating system, and full access to the host running the database. The attacker can then use this privileged access to launch subsequent attacks. These facilities include dropping into a command shell, creating user defined functions that can call system level libraries present on the host machine, stored procedures, etc.
  • SQL Injection
    This attack exploits target software that constructs SQL statements based on user input. An attacker crafts input strings so that when the target software constructs SQL statements based on the input, the resulting SQL statement performs actions other than those the application intended. SQL Injection results from failure of the application to appropriately validate input. When specially crafted user-controlled input consisting of SQL syntax is used without proper validation as part of SQL queries, it is possible to glean information from the database in ways not envisaged during application design. Depending upon the database and the design of the application, it may also be possible to leverage injection to have the database execute system-related commands of the attackers' choice. SQL Injection enables an attacker to talk directly to the database, thus bypassing the application completely. Successful injection can cause information disclosure as well as ability to add or modify data in the database. In order to successfully inject SQL and retrieve information from a database, an attacker:

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-8635280DE5.NASL
    description**Version 3.4.26** (2019-04-17) - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony) - bug #31142 Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id124514
    published2019-05-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124514
    titleFedora 30 : php-symfony3 (2019-8635280de5)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-7EAF0BBE7C.NASL
    description- https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124686
    published2019-05-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124686
    titleFedora 29 : drupal8 (2019-7eaf0bbe7c)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-A3CA65028C.NASL
    description**Version 3.4.26** (2019-04-17) - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony) - bug #31142 Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id124351
    published2019-04-29
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124351
    titleFedora 29 : php-symfony3 (2019-a3ca65028c)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-0EF4149687.NASL
    description**Version 2.8.50** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124471
    published2019-05-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124471
    titleFedora 30 : php-symfony (2019-0ef4149687)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4441.NASL
    descriptionMultiple vulnerabilities were discovered in the Symfony PHP framework which could lead to cache bypass, authentication bypass, information disclosure, open redirect, cross-site request forgery, deletion of arbitrary files, or arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id124779
    published2019-05-13
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124779
    titleDebian DSA-4441-1 : symfony - security update
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1778.NASL
    descriptionSeveral security vulnerabilities have been discovered in symfony, a PHP web application framework. Numerous symfony components are affected: Framework Bundle, Dependency Injection, Security, HttpFoundation CVE-2019-10909 Validation messages were not escaped when using the form theme of the PHP templating engine which, when validation messages may contain user input, could result in an XSS. For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in- the-php-templating-engine CVE-2019-10910 Service IDs derived from unfiltered user input could result in the execution of any arbitrary code, resulting in possible remote code execution. For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10910-check-service-ids-ar e-valid CVE-2019-10911 This fixes situations where part of an expiry time in a cookie could be considered part of the username, or part of the username could be considered part of the expiry time. An attacker could modify the remember me cookie and authenticate as a different user. This attack is only possible if remember me functionality is enabled and the two users share a password hash or the password hashes (e.g. UserInterface::getPassword()) are null for all users (which is valid if passwords are checked by an external system, e.g. an SSO). For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remembe r-me-cookie-hash CVE-2019-10913 HTTP methods, from either the HTTP method itself or using the X-Http-Method-Override header were previously returned as the method in question without validation being done on the string, meaning that they could be used in dangerous contexts when left unescaped. For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-ove rrides For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id124657
    published2019-05-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124657
    titleDebian DLA-1778-1 : symfony security update
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-32067D8B15.NASL
    description**Version 4.1.12** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [Cache][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124348
    published2019-04-29
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124348
    titleFedora 29 : php-symfony4 (2019-32067d8b15)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-2A7F472198.NASL
    description**Version 3.4.26** (2019-04-17) - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony) - bug #31142 Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id124347
    published2019-04-29
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124347
    titleFedora 28 : php-symfony3 (2019-2a7f472198)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_2BAD8B5D66FB11E9981578ACC0A3B880.NASL
    descriptionDrupal Security Team reports : CVE-2019-10909: Escape validation messages in the PHP templating engine. CVE-2019-10910: Check service IDs are valid. CVE-2019-10911: Add a separator in the remember me cookie hash. jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extend(true, {}, ...). If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions. It
    last seen2020-06-01
    modified2020-06-02
    plugin id124286
    published2019-04-25
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124286
    titleFreeBSD : drupal -- Drupal core - Moderately critical (2bad8b5d-66fb-11e9-9815-78acc0a3b880)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-F5D6A7CE74.NASL
    description**Version 4.2.7** (2019-04-17) - bug #31107 [Routing] fix trailing slash redirection with non-greedy trailing vars (nicolas-grekas) - bug #31108 [FrameworkBundle] decorate the ValidatorBuilder
    last seen2020-06-01
    modified2020-06-02
    plugin id124556
    published2019-05-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124556
    titleFedora 30 : php-symfony4 (2019-f5d6a7ce74)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-F8DB687840.NASL
    description**Version 2.8.50** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124352
    published2019-04-29
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124352
    titleFedora 29 : php-symfony (2019-f8db687840)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-EBA8E44EE6.NASL
    description- https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124688
    published2019-05-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124688
    titleFedora 30 : drupal8 (2019-eba8e44ee6)
  • NASL familyCGI abuses
    NASL idDRUPAL_8_5_15.NASL
    descriptionAccording to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.66, 8.5.x prior to 8.5.15, or 8.6.x prior to 8.6.15. It is, therefore, affected by multiple vulnerabilities. - The jQuery project released version 3.4.0, and as part of that, disclosed a security vulnerability that affects all prior versions. As described in their release notes: jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extend(true, {}, ...). If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions. It
    last seen2020-06-01
    modified2020-06-02
    plugin id124176
    published2019-04-19
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124176
    titleDrupal 7.x < 7.66 / 8.5.x < 8.5.15 / 8.6.x < 8.6.15 Multiple Vulnerabilities (drupal-2019-04-17)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-1A3EDD7E8A.NASL
    description- https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124685
    published2019-05-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124685
    titleFedora 28 : drupal8 (2019-1a3edd7e8a)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-3EE6A7ADF2.NASL
    description**Version 2.8.50** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124349
    published2019-04-29
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124349
    titleFedora 28 : php-symfony (2019-3ee6a7adf2)

The Hacker News

idTHN:E4F045381B383C8262F29CAF29C6AFE4
last seen2019-04-17
modified2019-04-17
published2019-04-17
reporterThe Hacker News
sourcehttps://thehackernews.com/2019/04/drupal-security-update.html
titleDrupal Releases Core CMS Updates to Patch Several Vulnerabilities