CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
55.8%
The Symfony HTTP cache system acts as a reverse proxy: it caches HTTP responses (including headers) and returns them to clients.
In a recent AbstractSessionListener
change, the response might now contain a Set-Cookie
header. If the Symfony HTTP cache system is enabled, this header might be stored and returned to some other clients. An attacker can use this vulnerability to retrieve the victim’s session.
The HttpStore
constructor now takes a parameter containing a list of private headers that are removed from the HTTP response headers.
The default value for this parameter is Set-Cookie
, but it can be overridden or extended by the application.
The patch for this issue is available here for branch 4.4.
We would like to thank Soner Sayakci for reporting the issue and Nicolas Grekas for fixing it.
github.com/advisories/GHSA-h7vf-5wrv-9fhv
github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-kernel/CVE-2022-24894.yaml
github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2022-24894.yaml
github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb
github.com/symfony/symfony/security/advisories/GHSA-h7vf-5wrv-9fhv
lists.debian.org/debian-lts-announce/2023/07/msg00014.html
nvd.nist.gov/vuln/detail/CVE-2022-24894
symfony.com/cve-2022-24894