GHSA-ph86-p8f6-f9r2 Symfony Vulnerable to Identity Spoofing via Unanchored DN Regex in X509Authenticator

• Packagist symfony/security-http: < 5.4.52 → fixed in 5.4.52 • Packagist symfony/security-http: >= 6.0.0-BETA1, < 6.4.40 → fixed in 6.4.40 • Packagist symfony/security-http: >= 7.0.0-BETA1, < 7.4.12 → fixed in 7.4.12 • Packagist symfony/security-http: >= 8.0.0-BETA1, < 8.0.12 → fixed in 8.0.12 • Packagist symfony/symfony: < 5.4.52 → fixed in 5.4.52 • Packagist symfony/symfony: >= 6.0.0-BETA1, < 6.4.40 → fixed in 6.4.40 • Packagist symfony/symfony: >= 7.0.0-BETA1, < 7.4.12 → fixed in 7.4.12 • Packagist symfony/symfony: >= 8.0.0-BETA1, < 8.0.12 → fixed in 8.0.12

Description `X509Authenticator` implements client-certificate (mTLS) authentication: the web server validates the client's certificate against a trusted CA, then passes the certificate's Subject DN (Distinguished Name: a string like `CN=Alice,O=Example,[email protected]`) to Symfony via `$_SERVER['SSL_CLIENT_S_DN']`. Symfony extracts the user identifier from that string. The extraction uses an unanchored regex that matches `emailAddress=` anywhere in the DN string: including inside the *value* of a different RDN (Relative Distinguished Name: one `key=value` component of the DN), such as `CN`. An attacker who can obtain a certificate from a trusted CA with a free-text `CN` can smuggle `emailAddress=victim@target` inside the CN value and be authenticated as the victim. Resolution The `X509Authenticator` now uses a regex that anchors the match to an RDN boundary (start of string, or following a `,` / `/` separator). The patch for this issue is available here for branch 5.4. Credits Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and providing the fix.