[HN Gopher] Bittersweet Symfony: Devs accidentally turn off CSRF...
___________________________________________________________________
Bittersweet Symfony: Devs accidentally turn off CSRF protection in
PHP framework
Author : feross
Score : 66 points
Date : 2022-02-03 17:01 UTC (5 hours ago)
(HTM) web link (portswigger.net)
(TXT) w3m dump (portswigger.net)
| mzs wrote:
| https://nvd.nist.gov/vuln/detail/CVE-2022-23601
| pmarreck wrote:
| Imagine unit-testing the functionality you claim to provide.
|
| Oh, wait, it's PHP... Nevermind.
| tombert wrote:
| Man, I haven't thought about Symfony in awhile.
|
| I took a job at a subcontracting about 9 years ago, where I was
| mostly doing Node.js work, but there were some projects using
| Symfony, and even after using it on/off for a month, I have to
| say I never really "got" it. I could tell there's _something_
| there that 's fairly cool, but I never really was able to wrap my
| head around all the folders.
|
| I've become a way better programmer since then, so I have thought
| about trying it out again, but nothing in my day job uses PHP
| anymore, and I've moved away from web since then.
| heurisko wrote:
| > but I never really was able to wrap my head around all the
| folders
|
| Modern Symfony changed a lot about directory structures, and no
| longer recommends to use bundles. Most things now are
| autowired.
| benbristow wrote:
| Symfony seems to be going strong still other than this issue.
|
| Laravel is the other big MVC framework for PHP.
| throwaway2016a wrote:
| CakePHP is also quite active and popular.
| benbristow wrote:
| That was quite popular a while back also. I tried to pick
| it up when I first got into web development and never
| really understood it (didn't really understand MVC at all)
| and started using CodeIgniter (which is also still going)
| instead which seemed more straight forward - although used
| it more like VC rather than MVC haha.
|
| Quite nice to see they're all going.
| jmisavage wrote:
| Yii seems to have its fans in that space. I know CraftCMS
| loves it.
| tombert wrote:
| Just remembered, doesn't Laravel use a lot of Symfony
| components? If that's true then I have used it a bit since
| 2013, if only indirectly.
| skipnup wrote:
| Still does, although you really don't notice while
| programming.
| mtberatwork wrote:
| Yes: https://packagist.org/packages/laravel/framework
| agumonkey wrote:
| I guess sf value in only understood in historical context.
| Compared to wordpress and ad-hoc code it was structured. Think
| jquery vs react I guess.
| jonwinstanley wrote:
| I really enjoyed using Symfony for a lot of years.
|
| The frameworks around before, Zend & CodeIgniter, were flawed
| in my opinion and Symfony was a breath of fresh air. More
| recently though, it feels like Laravel is doing a better job at
| letting people just get on with building a website.
| steve_adams_86 wrote:
| Personally I think Symfony (and digging around its source)
| helped me become a far better software developer. It wasn't
| perfect, but it was awesome at the time. I built some really
| cool applications with it early on. Over ten years ago now!
|
| No doubt about it though, some very talented people
| contributed to that project and I imagine they still do.
| Symfony was one of the lights in the dark if you ask me; PHP
| could be a very ugly thing at the time, but it proved that
| you could do great things with it by applying good practices
| and being diligent about reviewing and improving designs.
|
| One of the things that blew me away (I was pretty green at
| the time) was when they made all of Symfony modular, and
| other frameworks began consuming their components. The
| portability of all of it was so impressing and inspiring to
| me back then.
|
| Anyway, plenty of ways to criticize PHP and Symfony, but I
| think they did a stellar job. I built my career on that
| stuff. I haven't actually looked at it in quite a while,
| though.
| EGreg wrote:
| I would love for you to try this one and hear your feedback:
|
| https://github.com/Qbix/Platform
|
| It takes the best ideas from CodeIgniter, Symfony, Kohana,
| Drupal and Doctrine...
| mtberatwork wrote:
| To be fair, Zend and CodeIgniter had to juggle operating
| between PHP4/5 at the same time. The object model in PHP4 was
| mostly incomplete and just syntactic sugar. It also did some
| oddball things like flip-flop pass-by-value/reference.
| twistedpair wrote:
| Gotta have those belts and suspenders.
|
| So many PRs people ask, why should we add protective measure X,
| when we already have protective measure Y? Defense in depth, my
| friends.
| wolpoli wrote:
| Unfortunately, most people don't understand the technical
| nuance between protective measure X and Y will fall for it.
| People do seem to get the concept of defense in depth through
| when explained through the castle analogy.
| onnnon wrote:
| This issue was due to a change on how the default framework
| configuration was being set. The side effect was that if you
| didn't explicitly enable CSRF protection, it would default to
| being disabled. The issue was resolved/disclosed very quickly,
| and in a professional manor.
| lmilcin wrote:
| Professionalism, in my opinion, includes taking reasonable
| precautions to prevent the problem from happening.
|
| If you are professional you know what kind of potential
| problems might happen and you know what are reasonable possible
| approaches to handle it.
|
| If security of your piece of software relies on default values
| of some settings I would reasonably expect you to have
| automated tests to verify that these settings have correct
| values.
|
| Next time you hire an electrician who causes damage to your
| house because he did not follow procedure to wire it correctly,
| will you be still calling him "professional" because he quickly
| removed the short?
| alt227 wrote:
| Everyone makes mistakes. Its how you handle and rectify those
| mistakes which defines you.
| lmilcin wrote:
| I very much disagree.
|
| Yes -- it is important how you rectify those mistakes.
|
| But being quick at rectifying mistakes does not yet make
| your actions professional.
| pfraze wrote:
| Expectations of professionalism, software quality,
| process, and so on are all a matter of context. I'm not
| sure a FOSS web framework gets DQed for a quickly-
| rectified mistake. The expectations aren't that high and
| can't be that high.
| lnxg33k1 wrote:
| I agree with you, but open source software is given as-is, in
| any context, if you see the headers and/or README files
| and/or LICENSE files, it says that there is no warranty given
| and considering that the whole (tech) world sustains itself
| on stealing the work of volounteers, I would reply that if a
| piece of software is not professional, then invest to make
| some professional work that works for you
| lmilcin wrote:
| > I agree with you, but open source software is given as-
| is, in any context,
|
| But if you are calling somebody or something "professional"
| what you are saying is they act as if they were doing it in
| a certain way. If they don't follow the practices it does
| not matter if they are doing it for free.
|
| It is like saying a kid is doing something professionally
| (even if he is not) and argumenting that it is because he
| isn't paid for it.
| lnxg33k1 wrote:
| I think symfony developers are still good professionals,
| given the size of the project and the amount of
| contributors, having an error or not having a test case
| for something specific could be forgiven, I would reply
| that errors and bugs can slip in a codebase, I guess it's
| more important to create a test case to double check that
| a bug doesn't re-appear in the future after it has been
| fixed?
|
| I mean I fail to understand what are you trying to say,
| someone stops being a professional as soon as it hasn't
| covered a test case?
|
| Or are they kids just for having slipped a bug? Despite
| their work powers a lot of companies software (including
| the ones I work for)
|
| Are you just trolling?
| lmilcin wrote:
| The statement was that they acted professionally.
|
| I don't know if they are or are not professionals.
|
| It is just my opinion that being nice and prompt about
| removing cause of the damage after they have caused
| damage through recklessly ignoring industry standards
| cannot be reason to call their entire set of actions
| around this particular issue as "professional".
| jasonshaev wrote:
| FYI, the GP comment said "The issue was
| resolved/disclosed very quickly, and in a professional
| manor."
|
| So they didn't say their "entire set of actions" was
| "professional" just that it was disclosed and resolved
| professionally.
| 420official wrote:
| It shows lack of experience to suggest having a gap in
| testing is somehow "recklessly ignoring industry
| standards". If you look at Symfony's test suite it's
| clear that they take testing extremely seriously and keep
| their tests up to date in a way that's far superior to my
| experience with "industry standard". If you look at the
| fix for this issue which is linked from the OP you'd see
| that the first thing they did is add a unit test to
| prevent this kind of issue from happening again.
|
| If you consider that kind of behavior recklessly
| unprofessional I'd be amazed to see the kind of tests you
| write for your code.
| [deleted]
| BiteCode_dev wrote:
| A bit unrelated, but I find funny most frameworks don't even have
| something to prevent CSRF. Most devs don't even know what CSRF
| are, and some know it only as "the stuff I need to disable
| because some ajax POST won't work otherwise".
|
| In fact, every time somebody choose flask over Django, I ask what
| they are going to do about CSRF, only to get a blank stare. Same
| with manual PHP or using most nodejs web libs.
|
| There are so many websites that are vulnerable to this, and it's
| something we know well, and have solutions for. Imagine what we
| don't know about. The internet is really made of swiss cheese.
| vollmond wrote:
| Now that you mention it, I can't think of any other concept I
| eventually researched and learned about just because of
| frameworks complaining (Spring framework in my case).
| jonathan-adly wrote:
| Working with Django has completely spoiled me as a dev. Now, I
| really can't stand manually configuring a lot of the "normal"
| good-practices that Django gives you for free.
| BiteCode_dev wrote:
| XSS escaping, sql injection prevention, click-jacking
| protection, password hashing updates...
|
| Django provides so much security out of the box.
|
| That's before we even talk about features.
| tedivm wrote:
| Most people who use Flask are also using Flask-WTF for their
| forms, and the default "FlaskForm" object exposed by it uses
| CSRF tokens by default.
| BiteCode_dev wrote:
| Last month flask has been downloaded 45 177 334 times, flask-
| wtf 3 466 675 times. That's 7%.
| yes_man wrote:
| 1. Not all servers serve web pages. As for how big
| percentage of Flask users thus don't need CSRF is hard to
| guess
|
| 2. WTForms is not the only way to do CSRF tokens with Flask
|
| My point is that it's not plausible to infer with certainty
| that some large part of Flask users would not have CSRF
| tokens just because Flask has more downloads than Flask-WTF
| iqanq wrote:
| Don't these people have tests?
| purerandomness wrote:
| Tests cannot prove the absence of bugs, ever.
| WJW wrote:
| Sure, but this was the presence of a bug. In a web framework
| you can easily have a test that fails when CSRF
| vulnerabilities are present. It's not some zeroday that has
| just been published, CSRF has been known for a very long time
| now.
|
| As a demo, here is a link to an 1100 line file full of such
| tests for the Rails framework: https://github.com/rails/rails
| /blob/main/actionpack/test/con...
| pictur wrote:
| good question. obviously, such large libraries should have
| security tests independent of the existing tests.
| purerandomness wrote:
| They do, and the patch for this CVE adds a test case for this
| bug: https://github.com/symfony/symfony/commit/f0ffb775febdf0
| 7e57...
| mhitza wrote:
| Is CSRF still a thing with SameSite cookies default Lax
| configuration nowadays? (ignoring when explicitly disabled)
| Techbrunch wrote:
| If you are using an up to date version of Firefox, Edge or
| Chrome it defaults to Lax. The exceptions are Safari, IE and
| Safari for IOS. I don't think this is worth a 8.1 CVSS.
|
| Source: https://developer.mozilla.org/en-
| US/docs/Web/HTTP/Headers/Se...
| diroussel wrote:
| There is certainly less need for it now as browsers have many
| more mitigations in place than when CSRf was first introduced.
|
| But I would say yes you still need it for defence in depth.
|
| For instance in RFC6749 (OAuth 2.0) it says clients MUST
| implement CSRF for the redirection step.
| Rygu wrote:
| Here's the official blog:
| https://symfony.com/blog/cve-2022-23601-csrf-token-missing-i...
___________________________________________________________________
(page generated 2022-02-03 23:01 UTC)