PT-2020-21571 · Gosbundle · Gosbundle Websocketbundle

Published 2020-07-07 · Updated 2020-07-07

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GosBundle WebSocketBundle versions prior to 1.10.4 GosBundle WebSocketBundle versions prior to 2.6.1 GosBundle WebSocketBundle versions prior to 3.3.0

Description Inside the TopicDispatcher::onPublish() function, messages can be arbitrarily broadcasted to related topics if the dispatch() method fails. This failure can occur due to misconfigured callback definitions on topic routes, missing implementations of the TopicInterface, rejection by topics implementing SecuredTopicInterface, or unhandled exceptions. This can result in unintended broadcasts to the WebSocket server, potentially with sensitive data.

Recommendations For versions prior to 1.10.4, upgrade to 1.10.4 to resolve the issue. For versions prior to 2.6.1, upgrade to 2.6.1 to resolve the issue. For versions prior to 3.3.0, upgrade to 3.3.0 to resolve the issue. As a temporary workaround, consider modifying the TopicDispatcher::onPublish() function to prevent broadcasting event data when dispatch() fails, until an official patch can be applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

GHSA-WWGF-3XP7-CXJ4

Affected Products

Gosbundle Websocketbundle

References · 5

• https://osv.dev/vulnerability/GHSA-wwgf-3xp7-cxj4 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/commit/942fd37245cb724ba8cc8d6f11f075a1bd53b338 · Note
• https://github.com/GeniusesOfSymfony/WebSocketBundle/security/advisories/GHSA-wwgf-3xp7-cxj4 · Note
• https://github.com/GeniusesOfSymfony/WebSocketBundle · Note
• https://snyk.io/vuln/SNYK-PHP-GOSWEBSOCKETBUNDLE-575401 · Note