PT-2022-20467 · Unknown · Play Framework

Billy Autrey + 2 · Published 2022-06-02 · Updated 2022-06-11 · CVE-2022-31023

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Play Framework versions prior to 2.8.16

Description The issue concerns the generation of error messages containing sensitive information in Play Framework. When run in dev mode, Play Framework shows verbose errors for easy debugging, including an exception stack trace. This behavior is configured by the DefaultHttpErrorHandler based on the application mode. However, the static object DefaultHttpErrorHandler is configured to always show verbose errors, which can be inadvertently used in production or improperly configured as the injected error handler. This could result in verbose errors displaying to users in a production application, exposing sensitive information. Specifically, the constructor for CORSFilter and the apply method for CORSActionBuilder use the static object DefaultHttpErrorHandler as a default value.

Recommendations For versions prior to 2.8.16, when constructing a CORSFilter or CORSActionBuilder, ensure that a properly-configured error handler is passed. Generally, this should be done by using the HttpErrorHandler instance provided through dependency injection or through Play's BuiltInComponents. Ensure that the application is not using the DefaultHttpErrorHandler static object in any code that may be run in production. Update to Play Framework 2.8.16, where the DefaultHttpErrorHandler object has been changed to use the prod-mode behavior, and DevHttpErrorHandler has been introduced for the dev-mode behavior.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2022-31023

GHSA-P9P4-97G9-WCRH

Affected Products

Play Framework

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31023.json · Exploit
• https://github.com/playframework/playframework/pull/11305 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31023 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31023 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9p4-97g9-wcrh · Vendor Advisory
• https://github.com/playframework/playframework/releases/tag/2.8.16 · Note
• https://github.com/playframework/playframework/security/advisories/GHSA-p9p4-97g9-wcrh · Note
• https://github.com/playframework/playframework · Note
• https://t.me/cibsecurity/43764 · Telegram Post