Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Symfony CSRF Protection Vulnerability: HTTP Tokens Can Be Hijacked

CVE-2017-16653 · published 8 years ago
Summary

Symptoms of this vulnerability can occur when using Symfony versions 2.7.x below 2.7.38, 2.8.x below 2.8.31, 3.2.x below 3.2.14, 3.3.x below 3.3.13, 3.4-BETA5, and 4.0-BETA5. A hacker who intercepts a user's HTTP session can steal the CSRF token and use it to trick the user into performing unintended actions on your website. To fix this issue, update your Symfony version to the latest patched version.

What to do
  • Update symfony security-csrf to version 2.7.38.
  • Update symfony security-csrf to version 2.8.31.
  • Update symfony security-csrf to version 3.2.14.
  • Update symfony security-csrf to version 3.3.13.
  • Update symfony security to version 2.7.38.
  • Update symfony security to version 2.8.31.
  • Update symfony security to version 3.2.14.
  • Update symfony security to version 3.3.13.
  • Update symfony symfony to version 2.7.38.
  • Update symfony symfony to version 2.8.31.
  • Update symfony symfony to version 3.2.14.
  • Update symfony symfony to version 3.3.13.
Affected software
Ecosystem VendorProductAffected versions
composer symfony security-csrf >= 2.7.0, < 2.7.38
>= 2.8.0, < 2.8.31
>= 3.0.0, < 3.2.14
>= 3.3.0, < 3.3.13
Fix: upgrade to 2.7.38
composer symfony security >= 2.7.0, < 2.7.38
>= 2.8.0, < 2.8.31
>= 3.0.0, < 3.2.14
>= 3.3.0, < 3.3.13
Fix: upgrade to 2.7.38
composer symfony symfony >= 2.7.0, < 2.7.38
>= 2.8.0, < 2.8.31
>= 3.0.0, < 3.2.14
>= 3.3.0, < 3.3.13
Fix: upgrade to 2.7.38
– sensiolabs symfony >= 2.7.0, <= 2.7.37
>= 3.2.0, <= 3.2.13
>= 3.3.0, <= 3.3.12
>= 3.8.0, <= 3.8.30
cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
– debian debian_linux 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Original advisory text
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tok...
An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.9 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published6 Aug 2018
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-92x6-h2gr-8gxq · GHSA
CVE-2017-16653 · NVD
Track software like this
Free during beta