CVE-2020-35217 Cross-Site Request Forgery in Vert.x-Web framework

What is CVE-2020-35217?

CVE-2020-35217 is a high-severity vulnerability in n/a, published on 20 Jan 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need to provide a CSRF token in the request because the framework does not consider it. The cookies are automatically sent by the browser and the verification will always succeed, leading to a successful CSRF attack.

Weakness: CWE-352

Which versions are affected by CVE-2020-35217?

8 open source packages ship an affected version, including io.vertx:vertx-web. It affects 1 product.

Products include Eclipse Vert.x-Web.

How do I fix CVE-2020-35217?

Upgrade io.vertx:vertx-web to 4.0.0-milestone5 or later.

Is CVE-2020-35217 being exploited?

There is no known exploitation of CVE-2020-35217 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-1002 Eclipse Vert.x Web static handler file access denial Medium 6.9
• CVE-2023-24815 Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web Medium 4.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9q69-g5gc-9fgf.