CVE-2024-50341

Executive Summary

CVE-2024-50341 is a vulnerability in the Symfony symfony/security-bundle module, which integrates the Security component into the Symfony full-stack framework. The flaw allows an attacker to bypass the custom user_checker defined on a firewall when logging in programmatically via the Security::login method. This can lead to unauthorized login, as the user_checker is not invoked, potentially allowing users who should be blocked (e.g., disabled or banned accounts) to gain access. The vulnerability has a low CVSS score of 3.1, indicating limited impact, but it still poses a risk in environments relying on user_checker for access control.

Supply Chain & Package Security

This vulnerability affects the PHP ecosystem, specifically the Symfony framework. The symfony/security-bundle is a widely used package in PHP applications. Organizations using Symfony should verify their dependency versions and apply the patch immediately. The vulnerability is not related to WordPress, Apache, or Nginx.

CVSS Breakdown & Threat Level

• CVSS Score: 3.1 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The low score reflects that the vulnerability only allows unauthorized login (integrity impact) without compromising confidentiality or availability. However, in contexts where user_checker enforces critical policies (e.g., account suspension), this could be more severe.

Deep Dive & Mechanics

The Security::login method in Symfony provides a way to programmatically log in a user. When a firewall is configured with a custom user_checker, that checker is supposed to validate the user before login (e.g., checking if the account is active, not banned, etc.). In vulnerable versions, the user_checker is not called during programmatic login, meaning any user can be logged in without the checks being applied.

The root cause is a missing call to the user_checker in the Security::login method. The fix ensures that the user_checker is invoked before the user is authenticated.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

public function login(UserInterface $user, string $firewallName = null): void
{
    // ... token creation and authentication
    // Missing: $this->userChecker->checkPreAuth($user);
    // Missing: $this->userChecker->checkPostAuth($user);
}

Patched Code (simplified):

public function login(UserInterface $user, string $firewallName = null): void
{
    $this->userChecker->checkPreAuth($user);
    // ... token creation and authentication
    $this->userChecker->checkPostAuth($user);
}

The patch adds calls to checkPreAuth and checkPostAuth methods of the user_checker, ensuring that the user is validated before and after authentication.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would need to:

1. Identify a Symfony application using a firewall with a custom user_checker that blocks certain users (e.g., disabled accounts).
2. Obtain credentials for a blocked user (e.g., via phishing or credential stuffing).
3. Use the Security::login method programmatically (e.g., via a custom controller or API endpoint) to log in as that user.

Lab Setup:

• Install a vulnerable Symfony version (e.g., 6.4.9).
• Configure a firewall with a custom user_checker that rejects users with a specific role or status.
• Create a controller that uses Security::login to authenticate a user.
• Attempt to log in as a blocked user via that controller.

Exploit Code (Conceptual):

// In a controller
public function loginAction(Security $security): Response
{
    $user = $this->getUser('blocked_user'); // Assume this user is blocked by user_checker
    $security->login($user, 'main'); // This will bypass user_checker in vulnerable versions
    return new RedirectResponse('/dashboard');
}

Blue Team

To detect exploitation:

• Monitor logs for programmatic login attempts (e.g., calls to Security::login).
• Look for users logging in who should be blocked by user_checker policies.
• Review application logs for authentication events that bypass normal checks.

Indicators of Compromise (IOCs)

• Log Entries: Authentication events without corresponding user_checker validation logs.
• User Activity: Users with disabled or banned status successfully logging in.
• Application Behavior: Unexpected access to restricted areas by users who should be blocked.

Detection Engineering

YARA Rule

rule CVE_2024_50341_Symfony_UserChecker_Bypass {
    meta:
        description = "Detects vulnerable Symfony code that bypasses user_checker in Security::login"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-50341"
    strings:
        $vuln_func = "Security::login" nocase
        $user_checker = "user_checker" nocase
        $missing_call = "checkPreAuth" nocase
    condition:
        $vuln_func and not $missing_call
}

Sigma Rule

title: CVE-2024-50341 - Symfony User Checker Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-50341 where user_checker is bypassed
logsource:
    category: application
    product: symfony
detection:
    selection:
        event: "security.login"
        user_checker_called: false
    condition: selection
falsepositives:
    - Legitimate use of Security::login without user_checker (if configured)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-50341 - Symfony User Checker Bypass"; flow:to_server; content:"Security::login"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade to symfony/security-bundle versions 6.4.10, 7.0.10, or 7.1.3.
2. Workaround: No known workarounds. Ensure all programmatic logins use the patched method.
3. Monitoring: Enable logging for all authentication events and monitor for anomalies.
4. Access Control: Review and enforce user_checker policies to ensure they are applied consistently.

Valters IT
DevSecOps & Cyber Threat Intelligence