Ryan Weaver, Symfony core team member and SymfonyCasts founder, needs our help

CVE-2022-23601: CSRF token missing in forms

January 29, 2022 · Published by Avatar of Fabien Potencier Fabien Potencier

Affected versions

Symfony 5.3.14, 5.4.3, and 6.0.3 versions of the Symfony Framework Bundle is affected by this security issue.

The issue has been fixed in Symfony 5.3.15, 5.4.4, and 6.0.4.

Description

The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled.

In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks.

Resolution

Symfony restored the default configuration to enable the CSRF protection by default.

The patch for this issue is available here for branch 5.3.

Credits

We would like to thank Catalin Dan and David Lochner for reporting the issue and Jérémy Derussé for fixing the issue.

Published in #Security Advisories

Have found a security issue in Symfony? Send the details to security [at] symfony.com and don't disclose it publicly until we can provide a fix for it.

Manage your notification preferences to receive an email as soon as a Symfony security release is published.

Help the Symfony project!

As with any Open-Source project, contributing code or documentation is the most common way to help, but we also have a wide range of sponsoring opportunities.

Comments

Avatar of Anton Sukhachev
Anton Sukhachev said on Jan 31, 2022
You can check if CSRF protection is enabled with command:

php bin/console debug:config framework csrf_protection.enabled
Avatar of AnotherSymfonyUser
AnotherSymfonyUser said on Feb 1, 2022
does this affect 4.4.x branch? It seems, based on the post above, that it does not, yet GitHub is generating dependabot warnings about it on 4.4.x projects. Additionally, the suggested CSRF checker command in the comment above shows a value of NULL on all 4.4 projects of mine.
Avatar of AnotherSymfonyUser
AnotherSymfonyUser said on Feb 1, 2022
To clarify on my above comment, despite seeing a NULL value for

php bin/console debug:config framework csrf_protection.enabled

my forms do have hidden *_token values and do appear to properly handle csrf. Am I missing something, or does the null value indicate that these systems are using the default value of true?
Avatar of Ondřej Frei
Ondřej Frei said on Feb 1, 2022
Hello, it seems just versions released on January 28 are affected - https://twitter.com/fabpot/status/1487743275318628358. So 4.4 should be safe.
Avatar of Alexis Lefebvre
Alexis Lefebvre said on Feb 1, 2022
@Philip Ardery False alerts could have been reported because of wrong version ranges: https://github.com/Roave/SecurityAdvisories/issues/90#issuecomment-1026617126

Comments are closed.

To ensure that comments stay relevant, they are closed for old posts.