Symfony storing cookie headers in HttpCache

CVE-2022-24894

Summary

A session management issue was identified in the Symfony PHP framework that affects its HTTP cache system. This vulnerability allows for the potential exposure of user session cookies through cached responses. Specifically, if the HTTP cache is configured to store responses, an attacker could exploit this by sending requests that result in a 'Set-Cookie' header being cached. When another user accesses the same cached response, their session could be compromised as it might inadvertently reveal sensitive session information. This vulnerability has been addressed with a patch in Symfony's 4.4 version, emphasizing the need for developers to update their systems to mitigate risks associated with session exposure.

References