Symfony and Multiple Symfony Components < 5.4.52 / 6.x < 6.4.40 / 7.x < 7.4.12 / 8.x < 8.0.12 Multiple Vulnerabilities

#TRUSTED 3e86ccda61922e62d31d2dd0b05d8aae47aa1db547264fa1f4d22d4da468e935802c84f06ac0ecdb35bcda65e9e2e0550aee518ee52133d12b1db9868e315226ef7c75bf17bf05502cc599c115df257731e0733ca5d5ca5561c5b3e485467008a02a8cf6dd5569443df10a5ddffd09ece79055fdf24d924f43429f71f73aeb4ea7867ee08c84298b408e32da23878519375704935a9898024fde7f5a0ebde15f0807f24bd80d8f640ac82b10b8f56d3a03d088de68dfccdf3f4daf3359c3a602bdbcec671abe12321845b8b7ccbce2ecbc3ec12175f2232aefbbd571987ea018458e3c6aee0e4addcf57ea6a81ef4d342dc07f21556927ff9b357977312189ddca371ca07c8b48ec1ca7d8364c3a40e039214d291941b49981c9584e2c9db81d457364e1298be1da3ab1ee43adf59b7508272558901ed09e6ab40ae9bc5afa99b2045dd56fe5fa86bfcec24a6e8af0627608dc3ac2cac6d6a33a579cb9da227aa75b9deeb6dbe4ca0b91f083cd578cebc1f4a388566e835825b13610793dcd4990d6028fc0bdc8aaf1969842b882afbefe169f7813e93ddcc66a3b8c10cc75bb39db575eaa1d09ab0de6ff5a4838f3fc4e25ed420a450c3612b219d75ade4e0a9056ee9e680b1fa3f312382f57ec02e118a874e33373444bdbe4d09b20836f5fb1db90052815895a028a68aba4a3daf8526a337f1dded99c246e3a113d8e2ce0
#TRUST-RSA-SHA256 2f2430b3203501c4eb2d0f70c4d88daa1ca47c04332e8b810171a392f89a78fe3cc341d435e9638fda51eb737d0bd5a1f1556d2fdc152b585a9cc60d7d0b8e412e64f9331f6d0ea9e778daad5e4507ba58f3768f061ce8ee18dce17df47710c44529ae627464e1b4d716ae95bcec002b5653996a4bce3bc4e7593bc5ea15793d350e4f689660eabb0c28dc34367d38f7740eb0231ba1c18fbfd32e8aa11ff43de3dc32babf7e06ff594ab83b465c0d067b4787a646bbcec0a5bf279cfa86871647661a378644ee0a55ca2133408ed490cd81406b6625708591b52338c6d493f701f8da70ace517224d9337a7ab182ae1d8f00fb6b59c1782e5ce38c2c91a9bf9debd7ded6e17fae435f2201dae75c89a52640049cebcb652d19eb0c88645b501982eb493f60f2abab3c6ebf84077ed93577a3bb51e57673e7cdf6b8e22e6be1c14851ed060a5a914453622d75e2905ff9bffb4f880edf33023cfb76eda5427c5eca19f50eb64eb8698acf656650a3bd663b055e630705e2bcf9dd43cc2299612610a4a8eeb0aeb90dc3b58730a22aa9488ad04c1ffa2bde4c82edc5dd4183184f41b96383c240eff2e7412aabe0270f32b5af70988b47fa8982a3f861e2e8e4abf2c5f30058b2754683236fcc635fb2d3971e2bf0b8bdcd926b0ce0206bbff895cfa40dd719c491de8440de5c5b1f61b98f9ca2d54e02127860eb46b5b31eb52
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(318791);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/26");

  script_cve_id(
    "CVE-2026-45063",
    "CVE-2026-45065",
    "CVE-2026-45067",
    "CVE-2026-45068",
    "CVE-2026-45077"
  );
  script_xref(name:"IAVB", value:"2026-B-0140");

  script_name(english:"Symfony and Multiple Symfony Components < 5.4.52 / 6.x < 6.4.40 / 7.x < 7.4.12 / 8.x < 8.0.12 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A PHP library installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Symfony and/or its Symfony Monolog Bridge / MIME / Mailer / Routing / Security HTTP Components installed 
on the remote host is/are prior to 6.1.x prior to 6.4.40, 7.0.x prior to 7.4.12, 8.0.x prior to 8.0.12, and, therefore, 
affected by multiple vulnerabilities:

  - An authentication bypass vulnerability exists in Symfony Component's X509Authenticator client-certificate
    (mTLS) authentication due to use of an unanchored regex to extract the emailAddress from the Subject DN 
    string. An unauthenticated, remote attacker can exploit this, via a crafted client certificate containing 
    an emailAddress string embedded within the CN (Common Name) field, to bypass authentication and impersonate 
    arbitrary users. (CVE-2026-45063)

  - An unsafe deserialization vulnerability exists in Symfony Monolog Bridge Component's ServerLogCommand 
    (server:log console command) due to binding to all network interfaces (0.0.0.0:9911) by default and 
    performing unauthenticated PHP object deserialization without an allowed_classes, allowlist, or integrity 
    checks. An unauthenticated, remote attacker can exploit this, via crafted serialized PHP payloads sent to 
    TCP port 9911, to cause a denial of service or potentially achieve remote code execution through PHP object 
    injection with magic-method side effects, depending on available gadget chains in the target environment.
    (CVE-2026-45077)

  - A CRLF injection vulnerability exists in Symfony MIME Component's Address class due to the constructor 
    accepting email addresses with quoted local-parts containing raw \r\n bytes, despite being documented as 
    validating input. An authenticated, remote attacker can exploit this, via crafted email addresses with 
    embedded CRLF sequences in the local-part (e.g., 'x\r\nBcc: attacker@evil'@example.com), to inject arbitrary
    email headers and SMTP commands, enabling unauthorized email disclosure, spam relay, or other mail-system 
    abuse. (CVE-2026-45067)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number. Also note that this plugin does not distinguish between PHP packages installed via the OS package manager,
PHP packages installed via Composer, or other sources. As a result, packages provided by your OS package repository may
have backported fixes that this plugin may incorrectly report as vulnerable. Please refer to the OS-specific plugins for
CVE-2026-45063, CVE-2026-45065, CVE-2026-45067, CVE-2026-45068, and CVE-2026-45077 to check for backported fixes.");
  # https://symfony.com/blog/cve-2026-45063-identity-spoofing-via-unanchored-dn-regex-in-x509authenticator
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?c4d83d1a");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-ph86-p8f6-f9r2");
  # https://symfony.com/blog/cve-2026-45077-unauthenticated-php-object-deserialization-in-monologbridge-server-log-listener
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8e1a8335");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-m7v2-7gxm-vc2v");
  # https://symfony.com/blog/cve-2026-45067-email-header-smtp-command-injection-via-crlf-in-symfony-component-mime-address
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0f9de61e");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-qpmx-3rfj-7rhv");
  # https://symfony.com/blog/cve-2026-45068-argument-injection-in-sendmailtransport-via-dash-prefixed-recipient-address
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?4f43363b");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-xx3c-qf5g-hc39");
  # https://symfony.com/blog/cve-2026-45065-urlgenerator-route-requirement-bypass-via-unanchored-regex-alternation-off-site-host-url-injection
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?91e9926d");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-72xp-p242-47p9");
  script_set_attribute(attribute:"solution", value:
"Upgrade Symfony and/or its affected Components to version 5.4.52, 6.4.40, 7.4.12, 8.0.12, or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-45063");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/05/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/05");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"asset_categories", value:"component");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:sensiolabs:symfony");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("php_composer_enum_win.nbin");
  script_require_keys("language_library/package/composer/enumerated");

  exit(0);
}

include('vcf.inc');
include('vcf_extras_php_packages.inc');

get_kb_item_or_exit('language_library/package/composer/enumerated');

var packages = [
  {'component': 'symfony/symfony', 'name': 'Symfony'},
  {'component': 'symfony/security-http', 'name': 'Symfony Security HTTP Component'},
  {'component': 'symfony/routing', 'name': 'Symfony Routing Component'},
  {'component': 'symfony/mime', 'name': 'Symfony MIME Component'},
  {'component': 'symfony/mailer', 'name': 'Symfony Mailer Component'},
  {'component': 'symfony/monolog-bridge', 'name': 'Symfony Monolog Bridge Component'}
];

var constraints = [
  {'fixed_version': '5.4.52'},
  {'min_version': '6.1', 'fixed_version': '6.4.40'},
  {'min_version': '7.0', 'fixed_version': '7.4.12'},
  {'min_version': '8.0', 'fixed_version': '8.0.12'}
];

vcf::php_packages::process_multiple_packages_and_report(
  packages:packages,
  constraints:constraints,
  severity:SECURITY_HOLE
);