CVE-2021-32693 (PHP, published 2021-06-17T23:15Z)
Description: value: Symfony is a PHP framework for web and console applications and a set of reusable PHP components. A vulnerability related to firewall authentication is in Symfony starting with version 5.3.0 and prior to 5.3.2. When an application defines multiple firewalls, the token authenticated by one of the firewalls was available for all other firewalls. This could be abused when the application defines different providers for each part of the application, in such a situation, a user authenticated on a part of the application could be considered authenticated on the rest of the application. Starting in version 5.3.2, a patch ensures that the authenticated token is only available for the firewall that generates it.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/symfony/symfony
Files changed:
src/Symfony/Bundle/SecurityBundle/Tests/Functional/AuthenticatorTest.php
src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Authenticator/multiple_firewalls.yml
src/Symfony/Bundle/SecurityBundle/Tests/Functional/app/Authenticator/routing.yml
src/Symfony/Bundle/SecurityBundle/composer.json
src/Symfony/Component/Security/Http/Firewall/ContextListener.php
src/Symfony/Component/Security/Http/Tests/Firewall/ContextListenerTest.php
Commit message: Only trigger for the correct firewall in ContextListener::onKernelResponse()


Vulnerable code:
        "symfony/security-http": "^5.3"
        $request->attributes->set('_security_firewall_run', true);
        if (!$request->hasSession() || !$request->attributes->get('_security_firewall_run', false)) {
        $request->attributes->set('_security_firewall_run', true);
        $request->attributes->set('_security_firewall_run', true);
        $request->attributes->set('_security_firewall_run', true);

Fixed code:

    public function testMultipleFirewalls()
    {
        $client = $this->createClient(['test_case' => 'Authenticator', 'root_config' => 'multiple_firewalls.yml']);

        $client->request('POST', '/firewall1/login', [
            '_username' => 'jane@example.org',
            '_password' => 'test',
        ]);

        $client->request('GET', '/firewall2/profile');
        $this->assertResponseRedirects('http://localhost/login');
    }
imports:
- { resource: ./config.yml }
- { resource: ./security.yml }

security:
    enable_authenticator_manager: true
    firewalls:
        firewall1:
            pattern: /firewall1
            provider: in_memory
            form_login:
                check_path: /firewall1/login
        firewall2:
            pattern: /firewall2
            provider: in_memory2
            form_login:
                check_path: /firewall2/login

firewall1_login:
    path: /firewall1/login

firewall2_profile:
    path: /firewall2/profile
    defaults:
        _controller: Symfony\Bundle\SecurityBundle\Tests\Functional\Bundle\AuthenticatorBundle\ProfileController
        "symfony/security-http": "^5.3.2"
        $request->attributes->set('_security_firewall_run', $this->sessionKey);
        if (!$request->hasSession() || $request->attributes->get('_security_firewall_run') !== $this->sessionKey) {
        $request->attributes->set('_security_firewall_run', '_security_session');
        $request->attributes->set('_security_firewall_run', '_security_key123');
        $request->attributes->set('_security_firewall_run', '_security_session');