Bittersweet Symfony: Devs accidentally turn off CSRF protection in PHP framework

https://portswigger.net/daily-swig/bittersweet-symfony-devs-accidentally-turn-off-csrf-protection-in-php-framework

by feross • 4 years ago

78 55 4 years ago

mhitza• 4 years ago

Is CSRF still a thing with SameSite cookies default Lax configuration nowadays? (ignoring when explicitly disabled)

Techbrunch• 4 years ago

If you are using an up to date version of Firefox, Edge or Chrome it defaults to Lax. The exceptions are Safari, IE and Safari for IOS. I don't think this is worth a 8.1 CVSS.

Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Se...

diroussel• 4 years ago

There is certainly less need for it now as browsers have many more mitigations in place than when CSRf was first introduced.

But I would say yes you still need it for defence in depth.

For instance in RFC6749 (OAuth 2.0) it says clients MUST implement CSRF for the redirection step.

mzs• 4 years ago

https://nvd.nist.gov/vuln/detail/CVE-2022-23601

tombert2• 4 years ago

Man, I haven't thought about Symfony in awhile.

I took a job at a subcontracting about 9 years ago, where I was mostly doing Node.js work, but there were some projects using Symfony, and even after using it on/off for a month, I have to say I never really "got" it. I could tell there's something there that's fairly cool, but I never really was able to wrap my head around all the folders.

I've become a way better programmer since then, so I have thought about trying it out again, but nothing in my day job uses PHP anymore, and I've moved away from web since then.

benbristow2• 4 years ago

Symfony seems to be going strong still other than this issue.

Laravel is the other big MVC framework for PHP.

tombert2• 4 years ago

Just remembered, doesn't Laravel use a lot of Symfony components? If that's true then I have used it a bit since 2013, if only indirectly.

throwaway2016a• 4 years ago

CakePHP is also quite active and popular.

jmisavage• 4 years ago

Yii seems to have its fans in that space. I know CraftCMS loves it.

anaganisk2• 4 years ago

Isn’t laravel so alien, that they’re called laravel devs rather than php devs?

agumonkey• 4 years ago

I guess sf value in only understood in historical context. Compared to wordpress and ad-hoc code it was structured. Think jquery vs react I guess.

jonwinstanley2• 4 years ago

I really enjoyed using Symfony for a lot of years.

The frameworks around before, Zend & CodeIgniter, were flawed in my opinion and Symfony was a breath of fresh air. More recently though, it feels like Laravel is doing a better job at letting people just get on with building a website.

steve_adams_86• 4 years ago

Personally I think Symfony (and digging around its source) helped me become a far better software developer. It wasn't perfect, but it was awesome at the time. I built some really cool applications with it early on. Over ten years ago now!

No doubt about it though, some very talented people contributed to that project and I imagine they still do. Symfony was one of the lights in the dark if you ask me; PHP could be a very ugly thing at the time, but it proved that you could do great things with it by applying good practices and being diligent about reviewing and improving designs.

One of the things that blew me away (I was pretty green at the time) was when they made all of Symfony modular, and other frameworks began consuming their components. The portability of all of it was so impressing and inspiring to me back then.

Anyway, plenty of ways to criticize PHP and Symfony, but I think they did a stellar job. I built my career on that stuff. I haven't actually looked at it in quite a while, though.

EGreg• 4 years ago

I would love for you to try this one and hear your feedback:

https://github.com/Qbix/Platform

It takes the best ideas from CodeIgniter, Symfony, Kohana, Drupal and Doctrine…

mtberatwork2• 4 years ago

To be fair, Zend and CodeIgniter had to juggle operating between PHP4/5 at the same time. The object model in PHP4 was mostly incomplete and just syntactic sugar. It also did some oddball things like flip-flop pass-by-value/reference.

heurisko• 4 years ago

but I never really was able to wrap my head around all the folders

Modern Symfony changed a lot about directory structures, and no longer recommends to use bundles. Most things now are autowired.

twistedpair• 4 years ago

Gotta have those belts and suspenders.

So many PRs people ask, why should we add protective measure X, when we already have protective measure Y? Defense in depth, my friends.

wolpoli• 4 years ago

Unfortunately, most people don't understand the technical nuance between protective measure X and Y will fall for it. People do seem to get the concept of defense in depth through when explained through the castle analogy.

iqanq• 4 years ago

Don't these people have tests?

purerandomness2• 4 years ago

Tests cannot prove the absence of bugs, ever.

WJW• 4 years ago

Sure, but this was the presence of a bug. In a web framework you can easily have a test that fails when CSRF vulnerabilities are present. It's not some zeroday that has just been published, CSRF has been known for a very long time now.

As a demo, here is a link to an 1100 line file full of such tests for the Rails framework: https://github.com/rails/rails/blob/main/actionpack/test/con...

pictur• 4 years ago

good question. obviously, such large libraries should have security tests independent of the existing tests.

purerandomness2• 4 years ago

They do, and the patch for this CVE adds a test case for this bug: https://github.com/symfony/symfony/commit/f0ffb775febdf07e57...

Rygu• 4 years ago

Here's the official blog: https://symfony.com/blog/cve-2022-23601-csrf-token-missing-i...

onnnon• 4 years ago

This issue was due to a change on how the default framework configuration was being set. The side effect was that if you didn't explicitly enable CSRF protection, it would default to being disabled. The issue was resolved/disclosed very quickly, and in a professional manor.

lmilcin4• 4 years ago

Professionalism, in my opinion, includes taking reasonable precautions to prevent the problem from happening.

If you are professional you know what kind of potential problems might happen and you know what are reasonable possible approaches to handle it.

If security of your piece of software relies on default values of some settings I would reasonably expect you to have automated tests to verify that these settings have correct values.

Next time you hire an electrician who causes damage to your house because he did not follow procedure to wire it correctly, will you be still calling him "professional" because he quickly removed the short?

lnxg33k12• 4 years ago

I agree with you, but open source software is given as-is, in any context, if you see the headers and/or README files and/or LICENSE files, it says that there is no warranty given and considering that the whole (tech) world sustains itself on stealing the work of volounteers, I would reply that if a piece of software is not professional, then invest to make some professional work that works for you

alt227• 4 years ago

Everyone makes mistakes. Its how you handle and rectify those mistakes which defines you.

BiteCode_dev3• 4 years ago

A bit unrelated, but I find funny most frameworks don't even have something to prevent CSRF. Most devs don't even know what CSRF are, and some know it only as "the stuff I need to disable because some ajax POST won't work otherwise".

In fact, every time somebody choose flask over Django, I ask what they are going to do about CSRF, only to get a blank stare. Same with manual PHP or using most nodejs web libs.

There are so many websites that are vulnerable to this, and it's something we know well, and have solutions for. Imagine what we don't know about. The internet is really made of swiss cheese.

vollmond• 4 years ago

Now that you mention it, I can't think of any other concept I eventually researched and learned about just because of frameworks complaining (Spring framework in my case).

jonathan-adly• 4 years ago

Working with Django has completely spoiled me as a dev. Now, I really can't stand manually configuring a lot of the "normal" good-practices that Django gives you for free.

BiteCode_dev3• 4 years ago

XSS escaping, sql injection prevention, click-jacking protection, password hashing updates...

Django provides so much security out of the box.

That's before we even talk about features.

sshine• 4 years ago

Not for free.

It just feels free because you already paid with your time to learn the conventions. :)

tedivm• 4 years ago

Most people who use Flask are also using Flask-WTF for their forms, and the default "FlaskForm" object exposed by it uses CSRF tokens by default.

BiteCode_dev3• 4 years ago

Last month flask has been downloaded 45 177 334 times, flask-wtf 3 466 675 times. That's 7%.

nickjj• 4 years ago

Indeed, you can also create a Jinja macro to auto-insert the token into all of your forms too, here's a code example[0]. It's a 100% solved problem both on the Flask back-end and template side with an ability to opt out of it when you need to on the back-end such as when accepting webhooks from another service.

[0] https://github.com/nickjj/build-a-saas-app-with-flask/blob/1...

antihero• 4 years ago

I haven't really thought about CSRF since building things that are purely static frontend + JS request based. How prevalent are these things in this space? Are they still a problem?

phonethrowaway• 4 years ago

flask-security is a trivial addon.

pmarreck• 4 years ago

Imagine unit-testing the functionality you claim to provide.

Oh, wait, it's PHP... Nevermind.

anaganisk2• 4 years ago

A random library uses unsafe all along creating a lots of drama and drives author of said package into depression, ah never mind its rust.

A random package author removes a package from npm breaking thousands of apps, never mind its Nodejs.

A random package typo squats a famous package name making many apps vulnerable, never mind its python.

A random logging library grants access to shell, never mind its Java.

I could go on.

daudmalik06• 4 years ago

This happens very often, Vulert.com is very useful in this case it notifies you as soon as a vulnerability found in any open source software you use.

Bittersweet Symfony: Devs accidentally turn off CSRF protection in PHP framework

Related Stories