Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK
Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may accept OAuth 2.0 bearer access tokens from the token URL query parameter as well as the Authorization header for protected HTTP routes. Query-string tokens can be recorded in server logs, browser history, or referrer data and then replayed against protected API endpoints. This issue is fixed in version 5.9.0.
Auth0 Symfony SDK has Insufficient Entropy in Cookie Encryption
### Impact
In applications built with the Auth0 PHP SDK, cookies are encrypted with insufficient entropy, which may result in threat actors brute-forcing the encryption key and forging session cookies.
### Am I Affected?
Consumers are affected if their application meets the following preconditions:
- It uses the Auth0 Symfony SDK, versions between 5.0.0 and 5.7.0
- Auth0 Symfony SDK using the Auth0-PHP SDK versions between 8.0.0 to 8.18.0.
### Resolution
Upgrade Auth0/symfony-auth0 to version 5.8.0 or greater.
Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK
### Description
In applications built with the Auth0-PHP SDK, the audience validation in access tokens is performed improperly. Without proper validation, affected applications may accept ID tokens as Access tokens.
### Affected product and versions
Projects are affected if they meet the following preconditions:
- Applications using the Auth0 Symfony SDK with versions between 5.0.0 and 5.5.0
- Auth0 Symfony SDK uses the Auth0-PHP SDK with versions between 8.0.0 and 8.17.0.
### Resolution
Upgrade Auth0/symfony to version 5.6.0 or greater.
### Acknowledgement
Okta would like to thank Jafar Sadiq (iaf4r) for their discovery and responsible d
Auth0 Symfony SDK Does Not Properly Handle File Types in Bulk User Import
### Overview
In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs.
### Am I affected?
You are affected by this vulnerability if you meet the following preconditions:
1. Applications using the Auth0 Symfony SDK with versions between 2.0.2 and 5.4.1,
2. Auth0 Symfony SDK uses the Auth0-PHP SDK with versions between 3.3.0 and 8.16.0.
### Fix
Upgrade Auth0/symfony to version 5.5.0 or greater.
### Acknowledgement
Okta would like to thank Mohamed Amine Saidani (pwni) for discovering thi
Auth0 Symfony SDK Deserialization of Untrusted Data vulnerability
**Overview**
The Auth0 Symfony SDK contains a critical vulnerability due to insecure deserialization of cookie data. If exploited, since SDKs process cookie content without prior authentication, a threat actor could send a specially crafted cookie containing malicious serialized data.
**Am I Affected?**
You are affected by this vulnerability if you meet the following preconditions:
1. Applications using the Auth0 Symfony SDK, versions between 5.0.0 BETA-0 to 5.0.0.
2. Auth0 Symfony SDK uses the Auth0-PHP SDK with version 8.0.0-BETA3 to 8.3.0.
**Fix**
Upgrade Auth0/symfony to the latest version (v5.4.0).
**Acknowledgement**
Okta would li
Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
**Overview**
Session cookies of applications using the Auth0 symfony SDK configured with CookieStore have authentication tags that can be brute forced, which may result in unauthorized access.
**Am I Affected?**
You are affected by this vulnerability if you meet the following pre-conditions:
1. Applications using the Auth0 symfony SDK with version <=5.3.1
2. Auth0/Symfony SDK uses the Auth0-PHP SDK with version 8.0.0-BETA1 or higher and below 8.14.0.
3. Session storage configured with CookieStore.
**Fix**
Upgrade Auth0/symfony to v5.4.0. As an additional precautionary measure, we recommend rotating your cookie encryption keys. Note that o