Vulnerabilities > CVE-2019-10911 - Improper Authentication vulnerability in multiple products
Attack vector
NETWORK Attack complexity
HIGH Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Authentication Abuse An attacker obtains unauthorized access to an application, service or device either through knowledge of the inherent weaknesses of an authentication mechanism, or by exploiting a flaw in the authentication scheme's implementation. In such an attack an authentication mechanism is functioning but a carefully controlled sequence of events causes the mechanism to grant access to the attacker. This attack may exploit assumptions made by the target's authentication procedures, such as assumptions regarding trust relationships or assumptions regarding the generation of secret values. This attack differs from Authentication Bypass attacks in that Authentication Abuse allows the attacker to be certified as a valid user through illegitimate means, while Authentication Bypass allows the user to access protected material without ever being certified as an authenticated user. This attack does not rely on prior sessions established by successfully authenticating users, as relied upon for the "Exploitation of Session Variables, Resource IDs and other Trusted Credentials" attack patterns.
- Exploiting Trust in Client (aka Make the Client Invisible) An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
- Utilizing REST's Trust in the System Resource to Register Man in the Middle This attack utilizes a REST(REpresentational State Transfer)-style applications' trust in the system resources and environment to place man in the middle once SSL is terminated. Rest applications premise is that they leverage existing infrastructure to deliver web services functionality. An example of this is a Rest application that uses HTTP Get methods and receives a HTTP response with an XML document. These Rest style web services are deployed on existing infrastructure such as Apache and IIS web servers with no SOAP stack required. Unfortunately from a security standpoint, there frequently is no interoperable identity security mechanism deployed, so Rest developers often fall back to SSL to deliver security. In large data centers, SSL is typically terminated at the edge of the network - at the firewall, load balancer, or router. Once the SSL is terminated the HTTP request is in the clear (unless developers have hashed or encrypted the values, but this is rare). The attacker can utilize a sniffer such as Wireshark to snapshot the credentials, such as username and password that are passed in the clear once SSL is terminated. Once the attacker gathers these credentials, they can submit requests to the web service provider just as authorized user do. There is not typically an authentication on the client side, beyond what is passed in the request itself so once this is compromised, then this is generally sufficient to compromise the service's authentication scheme.
- Man in the Middle Attack This type of attack targets the communication between two components (typically client and server). The attacker places himself in the communication channel between the two components. Whenever one component attempts to communicate with the other (data flow, authentication challenges, etc.), the data first goes to the attacker, who has the opportunity to observe or alter it, and it is then passed on to the other component as if it was never intercepted. This interposition is transparent leaving the two compromised components unaware of the potential corruption or leakage of their communications. The potential for Man-in-the-Middle attacks yields an implicit lack of trust in communication or identify between two components.
Nessus
NASL family Fedora Local Security Checks NASL id FEDORA_2019-8635280DE5.NASL description **Version 3.4.26** (2019-04-17) - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony) - bug #31142 Revert last seen 2020-06-01 modified 2020-06-02 plugin id 124514 published 2019-05-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124514 title Fedora 30 : php-symfony3 (2019-8635280de5) NASL family Fedora Local Security Checks NASL id FEDORA_2019-7EAF0BBE7C.NASL description - https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124686 published 2019-05-08 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124686 title Fedora 29 : drupal8 (2019-7eaf0bbe7c) NASL family Fedora Local Security Checks NASL id FEDORA_2019-A3CA65028C.NASL description **Version 3.4.26** (2019-04-17) - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony) - bug #31142 Revert last seen 2020-06-01 modified 2020-06-02 plugin id 124351 published 2019-04-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124351 title Fedora 29 : php-symfony3 (2019-a3ca65028c) NASL family Fedora Local Security Checks NASL id FEDORA_2019-0EF4149687.NASL description **Version 2.8.50** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124471 published 2019-05-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124471 title Fedora 30 : php-symfony (2019-0ef4149687) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-4441.NASL description Multiple vulnerabilities were discovered in the Symfony PHP framework which could lead to cache bypass, authentication bypass, information disclosure, open redirect, cross-site request forgery, deletion of arbitrary files, or arbitrary code execution. last seen 2020-06-01 modified 2020-06-02 plugin id 124779 published 2019-05-13 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124779 title Debian DSA-4441-1 : symfony - security update NASL family Debian Local Security Checks NASL id DEBIAN_DLA-1778.NASL description Several security vulnerabilities have been discovered in symfony, a PHP web application framework. Numerous symfony components are affected: Framework Bundle, Dependency Injection, Security, HttpFoundation CVE-2019-10909 Validation messages were not escaped when using the form theme of the PHP templating engine which, when validation messages may contain user input, could result in an XSS. For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10909-escape-validation-messages-in- the-php-templating-engine CVE-2019-10910 Service IDs derived from unfiltered user input could result in the execution of any arbitrary code, resulting in possible remote code execution. For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10910-check-service-ids-ar e-valid CVE-2019-10911 This fixes situations where part of an expiry time in a cookie could be considered part of the username, or part of the username could be considered part of the expiry time. An attacker could modify the remember me cookie and authenticate as a different user. This attack is only possible if remember me functionality is enabled and the two users share a password hash or the password hashes (e.g. UserInterface::getPassword()) are null for all users (which is valid if passwords are checked by an external system, e.g. an SSO). For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10911-add-a-separator-in-the-remembe r-me-cookie-hash CVE-2019-10913 HTTP methods, from either the HTTP method itself or using the X-Http-Method-Override header were previously returned as the method in question without validation being done on the string, meaning that they could be used in dangerous contexts when left unescaped. For further information, see the upstream advisory at https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-ove rrides For Debian 8 last seen 2020-06-01 modified 2020-06-02 plugin id 124657 published 2019-05-07 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124657 title Debian DLA-1778-1 : symfony security update NASL family Fedora Local Security Checks NASL id FEDORA_2019-32067D8B15.NASL description **Version 4.1.12** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [Cache][PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124348 published 2019-04-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124348 title Fedora 29 : php-symfony4 (2019-32067d8b15) NASL family Fedora Local Security Checks NASL id FEDORA_2019-2A7F472198.NASL description **Version 3.4.26** (2019-04-17) - bug #31084 [HttpFoundation] Make MimeTypeExtensionGuesser case insensitive (vermeirentony) - bug #31142 Revert last seen 2020-06-01 modified 2020-06-02 plugin id 124347 published 2019-04-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124347 title Fedora 28 : php-symfony3 (2019-2a7f472198) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_2BAD8B5D66FB11E9981578ACC0A3B880.NASL description Drupal Security Team reports : CVE-2019-10909: Escape validation messages in the PHP templating engine. CVE-2019-10910: Check service IDs are valid. CVE-2019-10911: Add a separator in the remember me cookie hash. jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extend(true, {}, ...). If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions. It last seen 2020-06-01 modified 2020-06-02 plugin id 124286 published 2019-04-25 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124286 title FreeBSD : drupal -- Drupal core - Moderately critical (2bad8b5d-66fb-11e9-9815-78acc0a3b880) NASL family Fedora Local Security Checks NASL id FEDORA_2019-F5D6A7CE74.NASL description **Version 4.2.7** (2019-04-17) - bug #31107 [Routing] fix trailing slash redirection with non-greedy trailing vars (nicolas-grekas) - bug #31108 [FrameworkBundle] decorate the ValidatorBuilder last seen 2020-06-01 modified 2020-06-02 plugin id 124556 published 2019-05-02 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124556 title Fedora 30 : php-symfony4 (2019-f5d6a7ce74) NASL family Fedora Local Security Checks NASL id FEDORA_2019-F8DB687840.NASL description **Version 2.8.50** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124352 published 2019-04-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124352 title Fedora 29 : php-symfony (2019-f8db687840) NASL family Fedora Local Security Checks NASL id FEDORA_2019-EBA8E44EE6.NASL description - https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124688 published 2019-05-08 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124688 title Fedora 30 : drupal8 (2019-eba8e44ee6) NASL family CGI abuses NASL id DRUPAL_8_5_15.NASL description According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.66, 8.5.x prior to 8.5.15, or 8.6.x prior to 8.6.15. It is, therefore, affected by multiple vulnerabilities. - The jQuery project released version 3.4.0, and as part of that, disclosed a security vulnerability that affects all prior versions. As described in their release notes: jQuery 3.4.0 includes a fix for some unintended behavior when using jQuery.extend(true, {}, ...). If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype. This fix is included in jQuery 3.4.0, but patch diffs exist to patch previous jQuery versions. It last seen 2020-06-01 modified 2020-06-02 plugin id 124176 published 2019-04-19 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124176 title Drupal 7.x < 7.66 / 8.5.x < 8.5.15 / 8.6.x < 8.6.15 Multiple Vulnerabilities (drupal-2019-04-17) NASL family Fedora Local Security Checks NASL id FEDORA_2019-1A3EDD7E8A.NASL description - https://www.drupal.org/project/drupal/releases/8.6.15 - https://www.drupal.org/SA-CORE-2019-005 (CVE-2019-10909 / CVE-2019-10910 / CVE-2019-10911) - https://www.drupal.org/SA-CORE-2019-006 (CVE-2019-11358) - https://www.drupal.org/project/drupal/releases/8.6.14 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124685 published 2019-05-08 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124685 title Fedora 28 : drupal8 (2019-1a3edd7e8a) NASL family Fedora Local Security Checks NASL id FEDORA_2019-3EE6A7ADF2.NASL description **Version 2.8.50** (2019-04-17) - security #cve-2019-10910 [DI] Check service IDs are valid (nicolas-grekas) - security #cve-2019-10909 [FrameworkBundle][Form] Fix XSS issues in the form theme of the PHP templating engine (stof) - security #cve-2019-10912 [PHPUnit Bridge] Prevent destructors with side-effects from being unserialized (nicolas-grekas) - security #cve-2019-10911 [Security] Add a separator in the remember me cookie hash (pborreli) - security #cve-2019-10913 [HttpFoundation] reject invalid method override (nicolas-grekas) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 124349 published 2019-04-29 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124349 title Fedora 28 : php-symfony (2019-3ee6a7adf2)