GHSA-wwgf-3xp7-cxj4 Potentially sensitive data exposure in Symfony Web Socket Bundle
An attacker can receive sensitive data via unintended WebSocket broadcasts when topic dispatch fails due to misconfiguration or errors.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-wwgf-3xp7-cxj4?
GHSA-wwgf-3xp7-cxj4 is a vulnerability in gos/web-socket-bundle, published on 7 Jul 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Impact
Inside Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish(), messages are arbitrarily broadcasted to the related Topic if Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch() does not succeed. The dispatch() method can be considered to not succeed if (depending on the version of the bundle) the callback defined on a topic route is misconfigured, a Gos\Bundle\WebSocketBundle\Topic\TopicInterface implementation is not found for the callback, a topic which also implements Gos\Bundle\WebSocketBundle\Topic\SecuredTopicInterface rejects the connection, or an Exception is unhandled. This can result in an unintended broadcast to the websocket server potentially with data that should be considered sensitive.
Patches
In 1.10.4, 2.6.1, and 3.3.0, Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish() has been changed to no longer broadcast an event's data if Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch() fails.
Workarounds
Upgrade to 1.10.4, 2.6.1, and 3.3.0
Note, the 1.x branch is considered end of support as of July 1, 2020.
For more information
If you have any questions or comments about this advisory:
- Open an issue in this repository
Which versions are affected by GHSA-wwgf-3xp7-cxj4?
6 open source packages ship an affected version, including gos/web-socket-bundle.
| Package | Affected | Fixed in |
|---|---|---|
gos/web-socket-bundle Packagist | All versions | 1.10.4 |
gos/web-socket-bundle Packagist | All versions | 1.10.4 |
gos/web-socket-bundle Packagist | From 2.0.0 | 2.6.1 |
gos/web-socket-bundle Packagist | From 2.0.0 | 2.6.1 |
gos/web-socket-bundle Packagist | From 3.0.0 | 3.3.0 |
gos/web-socket-bundle Packagist | From 3.0.0 | 3.3.0 |
How do I fix GHSA-wwgf-3xp7-cxj4?
Upgrade gos/web-socket-bundle to a fixed version for your release line: 1.10.4, 2.6.1 or 3.3.0.
Is GHSA-wwgf-3xp7-cxj4 being exploited?
There is no known exploitation of GHSA-wwgf-3xp7-cxj4 in the wild and no public exploit code.