CyberRota Analysis
AI-GeneratedThe vulnerability affects Symfony UX versions 2.22.0 to 2.36.0 and 3.1.0, allowing attackers to exploit the isLiveComponentRequest() method to forge cross-origin #[LiveAction] requests. This can compromise user sessions when applications utilize permissive cookie policies and configurations like SameSite=None and credentials: 'include'. Developers and security teams using affected versions should prioritize upgrading to versions 2.36.0 or 3.1.0 to mitigate the risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Symfony UX is a JavaScript ecosystem for Symfony. From 2.22.0 until 2.36.0 and 3.1.0, Symfony\UX\LiveComponent\EventListener\LiveComponentSubscriber::isLiveComponentRequest() gates #[LiveAction] invocations on Accept: application/vnd.live-component+html, but the Accept header is CORS-safelisted and cross-origin fetch() can set it without preflight, allowing forged cross-origin #[LiveAction] requests against a victim session when applications use SameSite=None, credentials: 'include', a permissive cookie policy, or a same-origin pivot. This issue is fixed in versions 2.36.0 and 3.1.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)