Vulnerability · Published Nov 24, 2021 · Assigned by GitHub_M

CVE-2021-41270CSV Injection in Symfony

Medium 6.5

In plain English

A medium-severity security flaw in symfony from symfony. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)1.4%top 27.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Symfony/Serializer handles serializing and deserializing data structures for Symfony, a PHP framework for web and console applications and a set of reusable PHP components. Symfony versions 4.1.0 before 4.4.35 and versions 5.0.0 before 5.3.12 are vulnerable to CSV injection, also known as formula injection. In Symfony 4.1, maintainers added the opt-in `csv_escape_formulas` option in the `CsvEncoder`, to prefix all cells starting with `=`, `+`, `-` or `@` with a tab `\t`. Since then, OWASP added 2 chars in that list: Tab (0x09) and Carriage return (0x0D). This makes the previous prefix char (Tab `\t`) part of the vulnerable characters, and OWASP suggests using the single quote `'` for prefixing the value. Starting with versions 4.4.34 and 5.3.12, Symfony now follows the OWASP recommendations and uses the single quote `'` to prefix formulas and add the prefix to cells starting by `\t`, `\r` as well as `=`, `+`, `-` and `@`.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	symfony	4.4.19+dfsg-3	DEBIAN-CVE-2021-41270
Debian:13	symfony	4.4.19+dfsg-3	DEBIAN-CVE-2021-41270
Debian:14	symfony	4.4.19+dfsg-3	DEBIAN-CVE-2021-41270
Packagist	symfony/serializer	4.4.35	GHSA-2xhg-w2g5-w95x
Packagist	symfony/serializer	5.3.12	GHSA-2xhg-w2g5-w95x
Packagist	symfony/symfony	5.3.12	GHSA-2xhg-w2g5-w95x
Packagist	symfony/symfony	4.4.35	GHSA-2xhg-w2g5-w95x

Affected products (as reported)

Vendor	Product	Versions
symfony	symfony	>= 4.1.0, < 4.4.35>= 5.0.0, < 5.3.12

Weakness: CWE-1236 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/symfony/symfony/pull/44243 x_refsource_MISC
https://github.com/symfony/symfony/releases/tag/v5.3.12 x_refsource_MISC
https://github.com/symfony/symfony/security/advisories/GHSA-2xhg-w2g5-w95x x_refsource_CONFIRM
https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8 x_refsource_MISC
FEDORA-2021-0294e8ca24 vendor-advisory, x_refsource_FEDORA
FEDORA-2021-10fd47b32d vendor-advisory, x_refsource_FEDORA