PT-2019-4805 · Python · Python-Engineio

Stonemoe · Published 2019-07-15 · Updated 2024-07-12 · CVE-2019-13611

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions python-engineio versions 3.8.2 and earlier

Description The issue is related to a Cross-Site WebSocket Hijacking (CSWSH) vulnerability, also referred to as a Cross-Site Request Forgery (CSRF) vulnerability. This vulnerability allows attackers to make WebSocket connections to a server using a victim's credentials because the Origin header is not restricted. It affects Socket.IO and Engine.IO web servers that authenticate clients using cookies. The vulnerability can be exploited by a remote attacker to perform arbitrary actions in the vulnerable system.

Recommendations For python-engineio versions 3.8.2 and earlier, update to version 3.9.0, which patches this vulnerability by adding server-side Origin header checks. As a temporary workaround, consider not using cookies for client authentication, or add a CSRF token to the connection URL.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2020-01383

CVE-2019-13611

GHSA-J3JP-GVR5-7HWQ

OPENSUSE-SU-2024:11260-1

OPENSUSE-SU-2024:14157-1

PYSEC-2019-170

SUSE-SU-2019:2267-1

SUSE-SU-2019:2867-1

Affected Products

Python-Engineio

References · 162

• https://github.com/miguelgrinberg/python-engineio/issues/128 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-13611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13611 · Security Note
• https://osv.dev/vulnerability/PYSEC-2019-170 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14157-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-13611 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j3jp-gvr5-7hwq · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-13611 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2867-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01383 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13611 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-13611 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:2267-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13611 · Vendor Advisory
• https://github.com/miguelgrinberg/python-engineio · Note