PT-2020-18316 · Sylius · Syliusresourcebundle

Pamil · Published 2020-01-27 · Updated 2020-02-04 · CVE-2020-5220

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sylius ResourceBundle versions prior to 1.3.13 Sylius ResourceBundle versions 1.3.0 through 1.3.12 Sylius ResourceBundle versions 1.4.0 through 1.4.5 Sylius ResourceBundle versions 1.5.0 Sylius ResourceBundle versions 1.6.0 through 1.6.2

Description The issue arises from Sylius ResourceBundle accepting and using any serialisation groups passed via an HTTP header, potentially leading to data exposure by using an unintended serialisation group. For example, it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's controller is affected. The vulnerability also involves the ability to switch channels via the channel code GET parameter in production environments due to a configuration issue.

Recommendations For Sylius ResourceBundle versions prior to 1.3.13, update to version 1.3.13 or newer. For Sylius ResourceBundle versions 1.3.0 through 1.3.12, update to version 1.3.13 or newer. For Sylius ResourceBundle versions 1.4.0 through 1.4.5, update to version 1.4.6 or newer. For Sylius ResourceBundle version 1.5.0, update to version 1.5.1 or newer. For Sylius ResourceBundle versions 1.6.0 through 1.6.2, update to version 1.6.3 or newer. As a temporary workaround for unsupported versions, consider adding the configuration sylius channel: debug: false to prevent the debug feature from being enabled. Service sylius.resource controller.request configuration factory can be overridden to prevent the use of custom serialisation groups via the HTTP header.

Exploit

Fix

HTTP Request/Response Smuggling

Information Disclosure

Weakness Enumeration

CWE-444

CWE-200

Related Identifiers

CVE-2020-5220

GHSA-8VP7-J5CJ-VVM2

GHSA-PRG5-HG25-8GRQ

Affected Products

Syliusresourcebundle

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/resource-bundle/CVE-2020-5220.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/sylius/sylius/CVE-2020-5220.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2020-5220 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8vp7-j5cj-vvm2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5218 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-5220 · Security Note
• https://osv.dev/vulnerability/GHSA-prg5-hg25-8grq · Vendor Advisory
• https://github.com/Sylius/Sylius/security/advisories/GHSA-prg5-hg25-8grq · Note
• https://github.com/Sylius/SyliusResourceBundle/security/advisories/GHSA-8vp7-j5cj-vvm2 · Note
• https://t.me/cvenotify/486 · Telegram Post