Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-23601

CVE-2022-23601: CSRF token missing in Symfony

8.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-23601
GHSA ID
GHSA-vvmr-8829-6whx
EPSS Score
0.35496%
CWE
CWE-352
Published
2/1/2022
Updated
4/22/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
symfony/framework-bundlecomposer= 5.3.145.3.15
symfony/framework-bundlecomposer= 5.4.35.4.4
symfony/framework-bundlecomposer= 6.0.36.0.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from incorrect execution order in dependency injection configuration. The commit f0ffb775 shows critical changes:- 1) Moving form configuration registration AFTER CSRF configuration- 2) Adding explicit test cases for CSRF default enablement- 3) Reordering component initialization dependenciesThe original code processed form configuration (lines 314-333 in diff) before registering CSRF protection (line 462), preventing proper default CSRF enablement. The vulnerable function is the load() method where this misordering occurred, making CSRF protection contingent on explicit configuration rather than session status.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

**s*ription ----------- T** Sym*ony *orm *ompon*nt provi**s * *SR* prot**tion m****nism *y usin* * r*n*om tok*n inj**t** in t** *orm *n* usin* t** s*ssion to stor* *n* *ontrol t** tok*n su*mitt** *y t** us*r. W**n usin* t** *r*m*work*un*l*, t*is pro

Reasoning

T** vuln*r**ility st*mm** *rom in*orr**t *x**ution or**r in **p*n**n*y inj**tion *on*i*ur*tion. T** *ommit ******** s*ows *riti**l ***n**s:- *) Movin* *orm *on*i*ur*tion r**istr*tion **T*R *SR* *on*i*ur*tion- *) ***in* *xpli*it t*st **s*s *or *SR* **