PT-2020-12497 · Npm · Faye

Highjcoglan · Published 2020-04-29 · Updated 2020-05-06 · CVE-2020-11020

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4 Faye (NPM, RubyGem) versions 1.1.x before 1.1.3 Faye (NPM, RubyGem) versions 1.2.x before 1.2.5

Description The issue allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. This is caused by a bug in the server's code for recognizing special /meta/* channels. A client can bypass authentication checks by sending a message to a channel that is a prefix-match for one of the special channels, such as /meta/subscribe/x. This message will still be processed as a subscription request by the server, allowing the client to become subscribed to a channel without supplying the necessary credentials.

Recommendations For Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, update to version 1.0.4 or later. For Faye (NPM, RubyGem) versions 1.1.x before 1.1.3, update to version 1.1.3 or later. For Faye (NPM, RubyGem) versions 1.2.x before 1.2.5, update to version 1.2.5 or later. As a temporary workaround, consider modifying extensions to check if the message channel begins with the expected channel name, rather than exact matches. For example, use message.channel.startsWith('/meta/subscribe') instead of message.channel === '/meta/subscribe'.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-11020

GHSA-QPG4-4W7W-2MQ5

Affected Products

Faye

References · 13

• 🔥 https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5 · Exploit
• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/faye/CVE-2020-11020.yml · Exploit
• https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e · Patch
• https://osv.dev/vulnerability/GHSA-qpg4-4w7w-2mq5 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-11020 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-11020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11020 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11020 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-11020 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-11020 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-11020 · Vendor Advisory
• https://github.com/faye/faye · Note
• https://t.me/cvenotify/3418 · Telegram Post