CVE-2021-31406 Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
Attackers can bypass CSRF protection in Vaadin Fusion endpoints by exploiting a timing side channel to guess security tokens.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-31406?
CVE-2021-31406 is a medium-severity vulnerability in Vaadin, published on 23 Apr 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Non-constant-time comparison of CSRF tokens in endpoint request handler in com.vaadin:flow-server versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.
Which versions are affected by CVE-2021-31406?
4 open source packages ship an affected version, including com.vaadin:flow-server. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
com.vaadin:flow-server Maven | From 3.0.0 | 5.0.4 |
com.vaadin:flow-server Maven | From 3.0.0 | 5.0.4 |
com.vaadin:flow-server Maven | From 6.0.0 | 6.0.1 |
com.vaadin:flow-server Maven | From 6.0.0 | 6.0.1 |
Products include Vaadin Flow, Vaadin Vaadin.
How do I fix CVE-2021-31406?
Upgrade com.vaadin:flow-server to a fixed version for your release line: 5.0.4 or 6.0.1.
Is CVE-2021-31406 being exploited?
There is no known exploitation of CVE-2021-31406 in the wild and no public exploit code.
Other vulnerabilities in Vaadin
- CVE-2021-31407 Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
- CVE-2021-31405 Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
- CVE-2021-31411 Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
- CVE-2021-31408 Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
- CVE-2019-25027 Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Sources
Also known as GHSA-p7jq-v8jp-j424.