Affected versions Symfony 5.3.14, 5.4.3, and 6.0.3 versions of the Symfony Framework Bundle is affected by this security issue. The issue has been fixed in Symfony 5.3.15, 5.4.4, and 6.0.4.
Description The Symfony form component provides a CSRF protection mechanism by using a random token injected in the form and using the session to store and control the token submitted by the user. When using the FrameworkBundle, this protection can be enabled or disabled with the configuration. If the configuration is not specified, by default, the mechanism is enabled as long as the session is enabled. In a recent change in the way the configuration is loaded, the default behavior has been dropped and, as a result, the CSRF protection is not enabled in form when not explicitly enabled, which makes the application sensible to CSRF attacks.
Resolution Symfony restored the default configuration to enable the CSRF protection by default. The patch for this issue is available here for branch 5.3.
Credits We would like to thank Catalin Dan and David Lochner for reporting the issue and Jérémy Derussé for fixing the issue.
Sponsor the Symfony project.Inicia sesión para agregar comentarios
Otros mensajes en este grupo.
SymfonyLive Berlin 2025, conference held in English, will take place from April 1 to 4! The schedule is being revealed gradually. More details are available here. 🚨 Enjoy the last day before t
This week, Symfony 6.4.19 and 7.2.4 maintenance versions were released. In addition, the upcoming Symfony 7.3 version added a helper to render directory trees in the console. Lastly, we welcomed four
SymfonyLive Paris 2025, conference in French language only, will take place from March 27 to 28! The schedule is currently being revealed as we go along. More details are available here.
Al
SymfonyLive Berlin 2025, conference held in English, will take place from April 1 to 4! The schedule is being revealed gradually. More details are available here. 🚨 Enjoy the last few days bef
SymfonyLive Paris 2025, conference in French language only, will take place from March 27 to 28! The schedule is currently being revealed as we go along. More details are available here. 🚨 Tod
Symfony 6.4.19 has just been released. Here is the list of the most important changes since 6.4.18:
bug #59198 [Messenger] Filter out non-consumable receivers when registering ConsumeMessagesComm
Symfony 7.2.4 has just been released. Here is the list of the most important changes since 7.2.3:
bug #59198 [Messenger] Filter out non-consumable receivers when registering ConsumeMessagesComman