CVE-2023-46733: Symfony possible session fixation vulnerability
First published: Fri Nov 10 2023(Updated: )
### Description SessionStrategyListener does not always migrate the session after a successful login. It only migrate the session when the logged-in user identifier changes. In some use cases, the user identifier doesn't change between the verification phase and the successful login, while the token itself changes from one type (partially-authenticated) to another (fully-authenticated). When this happens, the session id should be regenerated to prevent possible session fixations. ### Resolution Symfony now checks the type of the token in addition to the user identifier before deciding whether the session id should be regenerated. The patch for this issue is available [here](https://github.com/symfony/symfony/commit/dc356499d5ceb86f7cf2b4c7f032eca97061ed74) for branch 5.4. ### Credits We would like to thank Robert Meijers for reporting the issue and providing the fix.
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/symfony/symfony | >=6.2.7<6.3.8 | 6.3.8 |
| composer/symfony/symfony | >=5.4.21<5.4.31 | 5.4.31 |
| composer/symfony/security-http | >=6.2.7<6.3.8 | 6.3.8 |
| composer/symfony/security-http | >=5.4.21<5.4.31 | 5.4.31 |
| SensioLabs Symfony | >=5.4.21<5.4.31 | |
| SensioLabs Symfony | >=6.2.7<6.3.8 | |
| >=5.4.21<5.4.31 | ||
| >=6.2.7<6.3.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/symfony/symfony/security/advisories/GHSA-m2wj-r6g3-fxfx
- https://nvd.nist.gov/vuln/detail/CVE-2023-46733
- https://github.com/symfony/symfony/commit/7467bd7e3f888b333102bc664b5e02ef1e7f88b9
- https://github.com/symfony/symfony/commit/dc356499d5ceb86f7cf2b4c7f032eca97061ed74
- https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2023-46733.yaml
- https://symfony.com/cve-2023-46733
- https://github.com/advisories/GHSA-m2wj-r6g3-fxfx (Advisory)
- collector/github-advisory-latest
- alias/GHSA-m2wj-r6g3-fxfx
- alias/CVE-2023-46733
- collector/github-advisory
- collector/nvd-cve
- agent/author
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/weakness
- agent/severity
- agent/title
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/tags
- agent/trending
- package-manager/composer
- vendor/sensiolabs
- canonical/sensiolabs symfony
- version/sensiolabs symfony/5.4.21
- version/sensiolabs symfony/6.2.7