| Package | Affected versions | Patched versions |
|---|---|---|
| symfony/security-http | ≥ 6.0.0-BETA1, < 6.4.40≥ 7.0.0-BETA1, < 7.4.12≥ 8.0.0-BETA1, < 8.0.12< 5.4.52 | 6.4.407.4.128.0.125.4.52 |
| symfony/symfony | ≥ 6.0.0-BETA1, < 6.4.40≥ 7.0.0-BETA1, < 7.4.12≥ 8.0.0-BETA1, < 8.0.12< 5.4.52 | 6.4.407.4.128.0.125.4.52 |
| symfony | ≥ 6.0.0, < 6.4.40≥ 7.0.0, < 7.4.12≥ 8.0.0, < 8.0.12< 5.4.52 | 6.4.407.4.128.0.125.4.52 |
X509Authenticator implements client-certificate (mTLS) authentication: the web server validates the client's certificate against a trusted CA, then passes the certificate's Subject DN (Distinguished Name: a string like CN=Alice,O=Example,[email protected]) to Symfony via $_SERVER['SSL_CLIENT_S_DN']. Symfony extracts the user identifier from that string.
The extraction uses an unanchored regex that matches emailAddress= anywhere in the DN string: including inside the value of a different RDN (Relative Distinguished Name: one key=value component of the DN), such as CN. An attacker who can obtain a certificate from a trusted CA with a free-text CN can smuggle emailAddress=victim@target inside the CN value and be authenticated as the victim.
The X509Authenticator now uses a regex that anchors the match to an RDN boundary (start of string, or following a , / / separator).
The patch for this issue is available here for branch 5.4.
Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free