GHSA-98j6-67v3-mw34 — Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

The advisory, in context

Overview The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.

Am I Affected? You are affected by this vulnerability if you meet the following preconditions:

Applications using the Auth0 Symfony SDK, versions between 5.0.0 BETA-0 to 5.0.0.
Auth0 Symfony SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.

Fix Upgrade Auth0/symfony to the latest version (v5.4.0).

Acknowledgement Okta would like to thank Andreas Forsblom for discovering this vulnerability.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

auth0/symfony Packagist

Ecosystem versions

From 5.0.0-BETA0 before 5.1.0

Fixed in 5.1.0

3 explicitly affected versions

5.0.0, 5.0.0-BETA0, 5.0.0-BETA1

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "5.0.0-BETA0"
        },
        {
          "fixed": "5.1.0"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "5.0.0",
    "5.0.0-BETA0",
    "5.0.0-BETA1"
  ]
}

Set up in your agent.

Investigate in your agent.

Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability

The advisory, in context

Affected packages

References