GHSA-wwgf-3xp7-cxj4 json
Potentially sensitive data exposure in Symfony Web Socket Bundle
published 6y ago modified last yr.
- cvss
- 5.9
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
### Impact Inside `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish()`, messages are arbitrarily broadcasted to the related Topic if `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch()` does not succeed. The `dispatch()` method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a `Gos\Bundle\WebSocketBundle\Topic\TopicInterface` implementation is not found for the callback, a topic which also implements `Gos\Bundle\WebSocketBundle\Topic\SecuredTopicInterface` rejects the connection, or an Exception is unhandled. This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.
### Patches In 1.10.4, 2.6.1, and 3.3.0, `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish()` has been changed to no longer broadcast an event's data if `Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch()` fails.
### Workarounds Upgrade to 1.10.4, 2.6.1, and 3.3.0
Note, the 1.x branch is considered end of support as of July 1, 2020.
### For more information If you have any questions or comments about this advisory: * Open an issue in [this repository](https://github.com/GeniusesOfSymfony/WebSocketBundle)
Patch / fix
- packagist gos/web-socket-bundle 1.10.4, 2.6.1, 3.3.0
Is GHSA-wwgf-3xp7-cxj4 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | gos/web-socket-bundle | <1.10.4 >=2.0.0, <2.6.1 >=3.0.0, <3.3.0 |
1.10.4 2.6.1 3.3.0 |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
Sources
- GitHub Advisory GHSA-wwgf-3xp7-cxj4
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.