3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-7jp2-5h22-m432

GHSA-7jp2-5h22-m432: Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import

Overview

In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.

Am I affected?

You are affected by this vulnerability if you meet the following preconditions:

Applications using the Auth0 Symfony SDK with versions between 2.0.2 and 5.4.1,
Auth0 Symfony SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.

Fix

Upgrade Auth0/symfony to version 5.5.0 or greater.

Acknowledgement

Okta would like to thank Mohamed Amine Saidani (pwni) for discovering this vulnerability.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-7jp2-5h22-m432

GHSA-7jp2-5h22-m432:

3.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
auth0/symfony	composer	>= 2.0.2, <= 5.4.1	5.5.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows for arbitrary file reads due to improper validation of file paths in the bulk user import feature. The investigation started by analyzing the provided commit for auth0/symfony, which revealed a dependency update for auth0/auth0-php. This indicated the vulnerability was in the underlying auth0/auth0-php library.

By comparing the git tags of auth0/auth0-php between the last vulnerable version (8.16.0) and the first patched version (8.17.0), I identified the commit that introduced the security fix. The commit 47555b615b3c5f324cdf1cecbeca8de990b92594 contains the relevant changes.

The analysis of the commit diffs revealed two key functions:

Auth0\SDK\Utility\HttpRequest::addFile: This function is the primary entry point for the vulnerability. Before the patch, it accepted a file path from the user and added it to the request without any validation. This is where an attacker would supply a malicious path (e.g., using a php:// wrapper).
Auth0\SDK\Utility\Assert::fileExists: This function was modified as part of the fix. The patch added a check to reject any file path containing ://, which prevents the use of PHP stream wrappers for remote or filtered file access. The vulnerability existed because HttpRequest::addFile relied on this function (and others) which did not perform this crucial validation.

Therefore, during exploitation, a profiler would show Auth0\SDK\Utility\HttpRequest::addFile being called with a malicious file path. This function, in turn, would have called the older, insecure version of Auth0\SDK\Utility\Assert::fileExists.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

3.3

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-7jp2-5h22-m432: Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import

Overview

Am I affected?

Fix

Acknowledgement

GHSA-7jp2-5h22-m432:

3.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Basic Information

Basic Information

Technical Details

GHSA-7jp2-5h22-m432: Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import

Overview

Am I affected?

Fix

Acknowledgement

3.3

3.3

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI