moften/cve-2024-51996CVE-2024-51996 es una vulnerabilidad crítica que afecta al componente security-http del framework Symfony.
Exploit for the critical vulnerability CVE-2024-51996, which allows authentication bypass in Symfony applications that use the Remember Me mechanism.
🧠 Impact: Impersonation of privileged users (such as
admin) without the need for valid credentials.
CVE-2024-51996 is a vulnerability in Symfony's security-http component. The flaw lies in the fact that the username contained in the REMEMBERME cookie is not properly validated, allowing it to be modified without invalidating the token.
An attacker with access to a valid cookie (for example, User1:token:series:hash) can modify it and replace the User1 identifier with any other registered username, such as admin.
python3 CVE-2024-51996_Exploit.py \
--url https://target.com \
--cookie "User1:token:series:hash" \
--spoof admin
If this tool has been useful to you or you want to support future developments, you can buy me a coffee ☕ or make a donation. Any support counts!
I believe in a world where users have control over their privacy. This tool was born from the trenches of real pentesting, with love for digital freedom and hacking with purpose.
⭐ If you liked this project, give it a star on GitHub and share it with your community.