Symfony DefaultAuthenticationFailureHandler Access Control Bypass Vulnerability

A vulnerability in Symfony's DefaultAuthenticationFailureHandler component can lead to unauthorized access to protected GET routes. This issue affects Symfony versions prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13. When the failure_forward option is enabled, the handler incorrectly honors user-supplied _failure_path parameters. This allows an unauthenticated user to exploit failing login requests by dispatching subrequests to access control-protected routes, bypassing firewall listeners. As a result, GET endpoints in administrative areas can be accessed without authentication.

Impact

Exploitation of this vulnerability allows unauthenticated access to access control-protected GET routes, potentially exposing sensitive data or functionality.

Reproduction

To reproduce this vulnerability, configure a firewall with form-login and set failure_forward to true. Then, send an unauthenticated POST request to the login check path, including a _failure_path parameter that points to a protected GET route. The subrequest will be executed without firewall protection, bypassing access controls.

Remediation

Users can update to Symfony versions 5.4.53, 6.4.41, 7.4.13, or 8.0.13 to address this vulnerability.