CVE-2020-5275

Executive Summary

CVE-2020-5275 is an authentication/authorization logic flaw in the symfony/security-http component of the Symfony PHP framework, affecting versions prior to 4.4.7 and 5.0.7. The vulnerability allows a Firewall to evaluate access control rules in a non-unanimous manner when an unanimous authorization strategy is configured, potentially permitting unauthorized access to protected application resources. Applications deploying the affected component as part of their user authentication and access control stack are at risk of authorization bypass, leading to unauthorized data access or privilege escalation. The vulnerability is patched in versions 4.4.7 and 5.0.7 of symfony/security-http.

Technical Analysis

The vulnerability resides in the symfony/security-http component, specifically within the Firewall class's handling of access control rules. The root cause is an iteration flaw: when the Firewall processes an access control rule, it iterates over each of the rule's attributes. The decision-making process (handled by the accessDecisionManager) stops as soon as a single attribute is granted access. This early termination prevents subsequent attributes within the same rule from being evaluated.

This behavior is problematic when the application is configured to use an unanimous voting strategy. In such a configuration, the accessDecisionManager is designed to require all attributes to be granted before access is permitted — a consensus among all checks. However, due to the iteration flaw, the manager effectively behaves like an affirmative (non-unanimous) strategy: only the first attribute granting access is evaluated, and the remaining attributes (which may represent additional security constraints or overlapping rules) are silently skipped.

Before the fix, the Firewall invoked the access decision manager with each attribute individually (one at a time). After the patch, the accessDecisionManager is called with all attributes at once, allowing the unanimous strategy to be correctly applied across the full set of attributes.

The attack surface is the application's HTTP-facing route layer. Any route protected by a firewall rule that specifies multiple attributes in a single access control rule becomes potentially exploitable. The fix ensures that the decision manager receives the complete attribute set in a single invocation, restoring the intended unanimous semantics.

No specific function names, class internals, or file paths beyond those mentioned in the NVD description (e.g., Firewall, accessDecisionManager) are disclosed in the available data. The vulnerability class is a logic/design flaw in authorization decision enforcement rather than a memory corruption or injection flaw.

Exploitation Scenarios

Step 1 — Reconnaissance/Target Identification: An attacker first fingerprints the target application to confirm it runs Symfony. This can be accomplished through HTTP response headers (e.g., X-Powered-By or Symfony-specific cookies), error message patterns, or obvious route structures. Tools such as Shodan or manual fingerprinting via crafted requests can reveal the framework. The attacker next identifies endpoints protected by firewall rules that enforces multiple attributes under a unanimous strategy.

Step 2 — Flaw Trigger: The attacker crafts a request to a protected endpoint. The trigger condition is an access control rule with multiple attributes (e.g., ROLE_ADMIN and an IP-based restriction). Because the firewall iterates and stops at the first granted attribute, the attacker only needs to satisfy the first attribute evaluated. If the first attribute is, for instance, session-based or token-based (which the attacker may control via a low-privileged account), it is granted and the remaining attributes—such as IP allowlisting or additional role requirements—are never evaluated. This effectively bypasses the unanimous consent requirement.

Step 3 — Payload/Execution: At the vulnerability-class level, this is an authorization bypass via logic error, not an injection or memory corruption. The "payload" is simply an HTTP request (GET, POST, PUT, DELETE) to a restricted resource. The attacker authenticates with any account (or no account if the first attribute is public), and the flawed early termination grants access despite other constraints failing.

Step 4 — Post-Exploitation Impact: Once a protected route is accessed without proper unanimous authorization, the attacker can retrieve sensitive data (e.g., user lists, personal information), invoke administrative functions, or tamper with application data. The exact impact depends on the protected endpoints. Where the bypass enables privilege escalation (e.g., reaching an admin panel), the attacker may achieve full application compromise.

No public PoC is available; the attack chain is inferred from the vulnerability description and class. Exploitation complexity is rated high per the CVSS vector (AC:H), likely due to the specific configuration requirements (unanimous strategy + multi-attribute rules) and the attacker's need to satisfy at least one attribute.

Impact Assessment

The CVSS v3 base score is 7.6 (High) with a vector of AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L. The vector indicates a network-exploitable flaw requiring high attack complexity (configurations must match the specific scenario), no privileges, and no user interaction. The scope is unchanged (U); the impact on confidentiality and integrity is High, while availability impact is Low.

Business Impact:

• Confidentiality Breach: An attacker can read data from protected endpoints, potentially exposing PII, credentials, or proprietary business data.
• Integrity Compromise: If write endpoints (POST/PUT/DELETE) are protected by the same flawed logic, the attacker can modify or delete data.
• Compliance Risks: For regulated industries (HIPAA, GDPR, PCI-DSS), unauthorized access to protected data constitutes a reportable breach.
• Reputation: A successful bypass undermines trust in the application's security posture.

Affected Systems: Any PHP application using Symfony security-http component versions below 4.4.7 or 5.0.7. This includes custom Symfony applications, API backends, and commercial products embedding Symfony components. The authoritative list of affected versions is limited; Debian is the sole patch-claiming source (patch confidence 2/4).

Blast Radius: The affected component is widely deployed in the PHP ecosystem, making the blast radius potentially large across open-source and commercial applications. However, exploitation is highly dependent on the specific firewall configuration using a unanimous strategy with multi-attribute rules — a non-default setup.

Detection Guidance

Sigma Rule

title: Symfony Security-http Access Control Bypass (CVE-2020-5275)
id: 71a3c2d4-9db0-4e7a-8c2e-4f6d1a3b5c7e
status: experimental
description: |
  Detects potential exploitation of CVE-2020-5275 in Symfony security-http.
  Monitors for suspicious access patterns to protected endpoints in Symfony applications.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2020-5275
author: Valtersit Threat Intel
date: 2024/01/20
logsource:
  category: application
  product: symfony
  service: firewall
detection:
  selection:
    event_type: security.access_denied
    http.response.status_code: 403
  filter_known_bad:
    http.url_extension|startswith:
      - '.css'
      - '.js'
      - '.png'
      - '.jpg'
  condition: selection and not filter_known_bad
falsepositives:
  - Legitimate users triggering rate-limiting or expired sessions
  - Misconfiguration in firewall rules
level: medium
tags:
  - attack.t1190
  - cve.2020-5275

YARA Rule

rule CVE_2020_5275_Symfony_Authorization_Bypass
{
    meta:
        author = "Valtersit Threat Intel"
        date = "2024-01-20"
        description = "Detects attempts to exploit CVE-2020-5275 Symfony security-http access control bypass"
        cve = "CVE-2020-5275"
        severity = "high"
    strings:
        $s1 = "accessDecisionManager" ascii nocase
        $s2 = "Firewall" ascii nocase
        $s3 = "unanimous" ascii nocase
        $s4 = "voter" ascii nocase
        $s5 = "decision" ascii nocase
    condition:
        all of them and filesize < 10MB
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2020-5275 Symfony Authorization Bypass Attempt"; flow:established; content:"GET"; http_method; content:"/admin/"; http_uri; content:"Authorization"; http_header; pcre:"/X-Symfony|PHPSESSID/"; reference:cve,2020-5275; classtype:attempted-admin; sid:20205275; rev:1;)

Elastic Detection

// Detect multiple failed access control events followed by a successful event
sequence by source.ip with maxspan=10m
  [ any where http.response.status_code == 403 and process.name == "php-fpm" ]
  [ any where http.response.status_code == 200 and url.path like "*/admin/*" ]

Splunk SPL Query

index=main sourcetype!=access_combined
| where like(url_path, "%/admin/%") AND status_code=200
| rex field=_raw "__public|__internal_ROLES"
| stats count by src_ip, user_agent, uri_path
| where count > 5
| table _time, src_ip, user_agent, uri_path
| sort - count

Wazuh OSSEC Rule

<group name="symfony,authorization,">
    <rule id="307794" level="10">
        <decoded>symfony</decoded>
        <match>AccessDecisionManager unanimous</match>
        <description>CVE-2020-5275: Unauthorized access attempt detected in Symfony application</description>
        <mitre>
            <id>T1190</id>
        </mitre>
        <group>access_control</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1) Immediate Mitigations:

• If upgrading is not immediately possible, reconfigure firewall access control rules to use a single attribute per rule. This eliminates the vulnerability condition (multiple attributes evaluated under a flawed iteration) without upgrading.
• Temporarily switch the accessDecisionManager strategy from unanimous to a more permissive strategy (e.g., affirmative), but ONLY if your application's security requirements permit this relaxation. This is a short-term mitigation; a strict authorization model should be maintained.
• Place a Web Application Firewall (WAF) rule to restrict access to known sensitive routes (e.g., /admin/*, /internal/*) at the network layer, regardless of application-level decisions.

2) Patch/Upgrade Steps:

• Upgrade symfony/security-http to version 4.4.7 (for the 4.4 branch) or version 5.0.7 (for the 5.0 branch), the first patched versions claimed by Debian.
• Run composer update symfony/security-http and ensure your composer.lock reflects the new version.
• After updating, verify that all firewall rules with multiple attributes enforce unanimous strategy correctly by running a regression test suite covering authorization scenarios.
• Check for other Symfony packages that might require synchronization (e.g., symfony/security-core, symfony/security-guard) to ensure version compatibility.

3) Long-Term Hardening:

• Adopt a layered authorization model: enforce role-based access control (RBAC) both at the framework level and within application logic.
• Implement centralized logging of all access control decisions to detect anomalous grant patterns.
• Regularly update Symfony components via automated dependency scanning tools (e.g., Dependabot, Renovate) to catch security patches early.
• Perform periodic security audits of firewall configuration files to ensure the unanimous strategy is correctly applied where required.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2020-5275
2. Symfony Security Advisory — https://symfony.com/blog/symfony-security-advisories (search for CVE-2020-5275)
3. Debian Security Tracker — https://security-tracker.debian.org/tracker/CVE-2020-5275
4. GitHub Advisory Database — https://github.com/advisories (search for GHSA identifier associated with CVE-2020-5275)
5. Symfony Blog / Security Release Announcement — https://symfony.com/blog (release notes for versions 4.4.7 and 5.0.7)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No public exploit code or documented in-the-wild campaigns were identified as of the report date. The EPSS score of 0.01148 (63.8th percentile) indicates a low but present probability of exploitation in the wild. No entries exist in the CISA KEV catalog, and no PoC or Nuclei templates were found publicly.