CVE-2024-51996 PoC — Symphony has an Authentication Bypass via RememberMe

Source

https://github.com/moften/CVE-2024-51996

Associated Vulnerability

Title:Symphony has an Authentication Bypass via RememberMe (CVE-2024-51996)
Description:Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted in the database matches the username attached with the cookie, leading to authentication bypass. This vulnerability is fixed in 5.4.47, 6.4.15, and 7.1.8.

Description

CVE-2024-51996 es una vulnerabilidad crítica que afecta al componente security-http del framework Symfony.

Readme

# CVE-2024-51996

CVE-2024-51996 es una vulnerabilidad crítica que afecta al componente security-http del framework Symfony. Esta falla se presenta en el mecanismo de autenticación “Remember Me”, específicamente en la forma en que Symfony procesa las cookies persistentes de autenticación.

En versiones vulnerables, Symfony no valida correctamente que el nombre de usuario contenido en la cookie REMEMBERME coincida con el que generó originalmente el token, lo que permite a un atacante que posea una cookie válida modificar el nombre de usuario para suplantar a otro sin necesidad de conocer su contraseña.

File Snapshot


 [4.0K]  /data/pocs/e83bbde8105604d2e94e3fc5527d9764afe11e5c
├── [ 491]  CVE-2024-51996.py
└── [ 620]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!