Vulnerabilities > CVE-2019-10911 - Improper Authentication vulnerability in multiple products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
high complexity
sensiolabs
drupal
CWE-287
nessus

Summary

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.

Vulnerable Configurations

Part Description Count
Application
Sensiolabs
125
Application
Drupal
39

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Authentication Abuse
    An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker. This attack may exploit assumptions made by the target's authentication procedures, such as assumptions regarding trust relationships or assumptions regarding the generation of secret values. This attack differs from Authentication Bypass attacks in that Authentication Abuse allows the attacker to be certified as a valid user through illegitimate means, while Authentication Bypass allows the user to access protected material without ever being certified as an authenticated user. This attack does not rely on prior sessions established by successfully authenticating users, as relied upon for the "Exploitation of Session Variables, Resource IDs and other Trusted Credentials" attack patterns.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Utilizing REST's Trust in the System Resource to Register Man in the Middle
    This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to place man in the middle once SSL is terminated. Rest applications premise is that they leverage existing infrastructure to deliver web services functionality. An example of this is a Rest application that uses HTTP Get methods and receives a HTTP response with an XML document. These Rest style web services are deployed on existing infrastructure such as Apache and IIS web servers with no SOAP stack required. Unfortunately from a security standpoint, there frequently is no interoperable identity security mechanism deployed, so Rest developers often fall back to SSL to deliver security. In large data centers, SSL is typically terminated at the edge of the network - at the firewall, load balancer, or router. Once the SSL is terminated the HTTP request is in the clear (unless developers have hashed or encrypted the values, but this is rare). The attacker can utilize a sniffer such as Wireshark to snapshot the credentials, such as username and password that are passed in the clear once SSL is terminated. Once the attacker gathers these credentials, they can submit requests to the web service provider just as authorized user do. There is not typically an authentication on the client side, beyond what is passed in the request itself so once this is compromised, then this is generally sufficient to compromise the service's authentication scheme.
  • Man in the Middle Attack
    This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-8635280DE5.NASL
    description**Version 3.4.26** (2019-04-17) - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony) - bug #31142 Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id124514
    published2019-05-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124514
    titleFedora 30 : php-symfony3 (2019-8635280de5)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-7EAF0BBE7C.NASL
    description- https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124686
    published2019-05-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124686
    titleFedora 29 : drupal8 (2019-7eaf0bbe7c)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-A3CA65028C.NASL
    description**Version 3.4.26** (2019-04-17) - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony) - bug #31142 Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id124351
    published2019-04-29
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124351
    titleFedora 29 : php-symfony3 (2019-a3ca65028c)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-0EF4149687.NASL
    description**Version 2.8.50** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124471
    published2019-05-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124471
    titleFedora 30 : php-symfony (2019-0ef4149687)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4441.NASL
    descriptionMultiple vulnerabilities were discovered in the Symfony PHP framework which could lead to cache bypass, authentication bypass, information disclosure, open redirect, cross-site request forgery, deletion of arbitrary files, or arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id124779
    published2019-05-13
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124779
    titleDebian DSA-4441-1 : symfony - security update
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1778.NASL
    descriptionSeveral security vulnerabilities have been discovered in symfony, a PHP web application framework. Numerous symfony components are affected: Framework Bundle, Dependency Injection, Security, HttpFoundation CVE-2019-10909 Validation messages were not escaped when using the form theme of the PHP templating engine which, when validation messages may contain user input, could result in an XSS. For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in- the-php-templating-engine CVE-2019-10910 Service IDs derived from unfiltered user input could result in the execution of any arbitrary code, resulting in possible remote code execution. For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10910-check-service-ids-ar e-valid CVE-2019-10911 This fixes situations where part of an expiry time in a cookie could be considered part of the username, or part of the username could be considered part of the expiry time. An attacker could modify the remember me cookie and authenticate as a different user. This attack is only possible if remember me functionality is enabled and the two users share a password hash or the password hashes (e.g. UserInterface::getPassword()) are null for all users (which is valid if passwords are checked by an external system, e.g. an SSO). For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remembe r-me-cookie-hash CVE-2019-10913 HTTP methods, from either the HTTP method itself or using the X-Http-Method-Override header were previously returned as the method in question without validation being done on the string, meaning that they could be used in dangerous contexts when left unescaped. For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-ove rrides For Debian 8
    last seen2020-06-01
    modified2020-06-02
    plugin id124657
    published2019-05-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124657
    titleDebian DLA-1778-1 : symfony security update
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-32067D8B15.NASL
    description**Version 4.1.12** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [Cache][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124348
    published2019-04-29
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124348
    titleFedora 29 : php-symfony4 (2019-32067d8b15)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-2A7F472198.NASL
    description**Version 3.4.26** (2019-04-17) - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony) - bug #31142 Revert
    last seen2020-06-01
    modified2020-06-02
    plugin id124347
    published2019-04-29
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124347
    titleFedora 28 : php-symfony3 (2019-2a7f472198)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_2BAD8B5D66FB11E9981578ACC0A3B880.NASL
    descriptionDrupal Security Team reports : CVE-2019-10909: Escape validation messages in the PHP templating engine. CVE-2019-10910: Check service IDs are valid. CVE-2019-10911: Add a separator in the remember me cookie hash. jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extend(true, {}, ...). If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions. It
    last seen2020-06-01
    modified2020-06-02
    plugin id124286
    published2019-04-25
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124286
    titleFreeBSD : drupal -- Drupal core - Moderately critical (2bad8b5d-66fb-11e9-9815-78acc0a3b880)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-F5D6A7CE74.NASL
    description**Version 4.2.7** (2019-04-17) - bug #31107 [Routing] fix trailing slash redirection with non-greedy trailing vars (nicolas-grekas) - bug #31108 [FrameworkBundle] decorate the ValidatorBuilder
    last seen2020-06-01
    modified2020-06-02
    plugin id124556
    published2019-05-02
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124556
    titleFedora 30 : php-symfony4 (2019-f5d6a7ce74)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-F8DB687840.NASL
    description**Version 2.8.50** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124352
    published2019-04-29
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124352
    titleFedora 29 : php-symfony (2019-f8db687840)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-EBA8E44EE6.NASL
    description- https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124688
    published2019-05-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124688
    titleFedora 30 : drupal8 (2019-eba8e44ee6)
  • NASL familyCGI abuses
    NASL idDRUPAL_8_5_15.NASL
    descriptionAccording to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.66, 8.5.x prior to 8.5.15, or 8.6.x prior to 8.6.15. It is, therefore, affected by multiple vulnerabilities. - The jQuery project released version 3.4.0, and as part of that, disclosed a security vulnerability that affects all prior versions. As described in their release notes: jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extend(true, {}, ...). If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions. It
    last seen2020-06-01
    modified2020-06-02
    plugin id124176
    published2019-04-19
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124176
    titleDrupal 7.x < 7.66 / 8.5.x < 8.5.15 / 8.6.x < 8.6.15 Multiple Vulnerabilities (drupal-2019-04-17)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-1A3EDD7E8A.NASL
    description- https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124685
    published2019-05-08
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124685
    titleFedora 28 : drupal8 (2019-1a3edd7e8a)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2019-3EE6A7ADF2.NASL
    description**Version 2.8.50** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124349
    published2019-04-29
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124349
    titleFedora 28 : php-symfony (2019-3ee6a7adf2)