ghsa-7563-75j9-6h5p
Vulnerability from github
Published
2022-03-14 22:26
Modified
2022-03-15 21:47
Severity ?
5.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Summary
Sensitive Information Exposure in Sylius
Details

Impact

Any other user can view the data if the browser tab remains open after logging out. Once someone logs out and leaves the browser open, the potential attacker may use the back button to see the content exposed on given screens. No action may be performed though, and any website refresh will block further reads. It may, however, lead to a data leak, like for example customer details, payment gateway configuration, etc.- but only if these were pages checked by the administrator.

This vulnerability requires full access to the computer to take advantage of it.

Patches

The issue is fixed in versions: 1.9.10, 1.10.11, 1.11.2 and above.

Workarounds

The application must strictly redirect to the login page even when the browser back button is pressed. Another possibility is to set more strict cache policies for restricted content (like no-store). It can be achieved with the following class:

```php <?php

declare(strict_types=1);

namespace App\EventListener;

use App\SectionResolver\ShopCustomerAccountSubSection; use Sylius\Bundle\AdminBundle\SectionResolver\AdminSection; use Sylius\Bundle\CoreBundle\SectionResolver\SectionProviderInterface; use Symfony\Component\EventDispatcher\EventSubscriberInterface; use Symfony\Component\HttpKernel\Event\ResponseEvent; use Symfony\Component\HttpKernel\KernelEvents;

final class CacheControlSubscriber implements EventSubscriberInterface { /* @var SectionProviderInterface / private $sectionProvider;

public function __construct(SectionProviderInterface $sectionProvider)
{
    $this->sectionProvider = $sectionProvider;
}

public static function getSubscribedEvents(): array
{
    return [
        KernelEvents::RESPONSE => 'setCacheControlDirectives',
    ];
}

public function setCacheControlDirectives(ResponseEvent $event): void
{
    if (
        !$this->sectionProvider->getSection() instanceof AdminSection &&
        !$this->sectionProvider->getSection() instanceof ShopCustomerAccountSubSection
    ) {
        return;
    }

    $response = $event->getResponse();

    $response->headers->addCacheControlDirective('no-cache', true);
    $response->headers->addCacheControlDirective('max-age', '0');
    $response->headers->addCacheControlDirective('must-revalidate', true);
    $response->headers->addCacheControlDirective('no-store', true);
}

} ```

After that register service in the container:

yaml services: App\EventListener\CacheControlSubscriber: arguments: ['@sylius.section_resolver.uri_based_section_resolver'] tags: - { name: kernel.event_subscriber, event: kernel.response }

The code above requires changes in ShopUriBasedSectionResolver in order to work. To backport mentioned logic, you need to replace the Sylius\Bundle\ShopBundle\SectionResolver\ShopUriBasedSectionResolver class with:

```php <?php

declare(strict_types=1);

namespace App\SectionResolver;

use Sylius\Bundle\CoreBundle\SectionResolver\SectionInterface; use Sylius\Bundle\CoreBundle\SectionResolver\UriBasedSectionResolverInterface; use Sylius\Bundle\ShopBundle\SectionResolver\ShopSection;

final class ShopUriBasedSectionResolver implements UriBasedSectionResolverInterface { /* @var string / private $shopCustomerAccountUri;

public function __construct(string $shopCustomerAccountUri = 'account')
{
    $this->shopCustomerAccountUri = $shopCustomerAccountUri;
}

public function getSection(string $uri): SectionInterface
{
    if (str_contains($uri, $this->shopCustomerAccountUri)) {
        return new ShopCustomerAccountSubSection();
    }

    return new ShopSection();
}

} ```

yaml services: sylius.section_resolver.shop_uri_based_section_resolver: class: App\SectionResolver\ShopUriBasedSectionResolver tags: - { name: sylius.uri_based_section_resolver, priority: -10 }

You also need to define a new subsection for the Customer Account that is used in the above services:

```php <?php

declare(strict_types=1);

namespace App\SectionResolver;

use Sylius\Bundle\ShopBundle\SectionResolver\ShopSection;

class ShopCustomerAccountSubSection extends ShopSection { } ```

References

  • Originally published at https://huntr.dev/

For more information

If you have any questions or comments about this advisory: * Open an issue in Sylius issues * Email us at security@sylius.com

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/sylius"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/sylius"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.10"
            },
            {
              "fixed": "1.10.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "sylius/sylius"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.11"
            },
            {
              "fixed": "1.11.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-24742"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-213",
      "CWE-668"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-14T22:26:58Z",
    "nvd_published_at": "2022-03-14T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nAny other user can view the data if the browser tab remains open after logging out. Once someone logs out and leaves the browser open, the potential attacker may use the back button to see the content exposed on given screens. No action may be performed though, and any website refresh will block further reads. It may, however, lead to a data leak, like for example customer details, payment gateway configuration, etc.- but only if these were pages checked by the administrator. \n\nThis vulnerability requires full access to the computer to take advantage of it.\n\n### Patches\nThe issue is fixed in versions: 1.9.10, 1.10.11, 1.11.2 and above.\n\n### Workarounds\nThe application must strictly redirect to the login page even when the browser back button is pressed. Another possibility is to set more strict cache policies for restricted content (like no-store). It can be achieved with the following class:\n\n```php\n\u003c?php\n\ndeclare(strict_types=1);\n\nnamespace App\\EventListener;\n\nuse App\\SectionResolver\\ShopCustomerAccountSubSection;\nuse Sylius\\Bundle\\AdminBundle\\SectionResolver\\AdminSection;\nuse Sylius\\Bundle\\CoreBundle\\SectionResolver\\SectionProviderInterface;\nuse Symfony\\Component\\EventDispatcher\\EventSubscriberInterface;\nuse Symfony\\Component\\HttpKernel\\Event\\ResponseEvent;\nuse Symfony\\Component\\HttpKernel\\KernelEvents;\n\nfinal class CacheControlSubscriber implements EventSubscriberInterface\n{\n    /** @var SectionProviderInterface */\n    private $sectionProvider;\n\n    public function __construct(SectionProviderInterface $sectionProvider)\n    {\n        $this-\u003esectionProvider = $sectionProvider;\n    }\n\n    public static function getSubscribedEvents(): array\n    {\n        return [\n            KernelEvents::RESPONSE =\u003e \u0027setCacheControlDirectives\u0027,\n        ];\n    }\n\n    public function setCacheControlDirectives(ResponseEvent $event): void\n    {\n        if (\n            !$this-\u003esectionProvider-\u003egetSection() instanceof AdminSection \u0026\u0026\n            !$this-\u003esectionProvider-\u003egetSection() instanceof ShopCustomerAccountSubSection\n        ) {\n            return;\n        }\n\n        $response = $event-\u003egetResponse();\n\n        $response-\u003eheaders-\u003eaddCacheControlDirective(\u0027no-cache\u0027, true);\n        $response-\u003eheaders-\u003eaddCacheControlDirective(\u0027max-age\u0027, \u00270\u0027);\n        $response-\u003eheaders-\u003eaddCacheControlDirective(\u0027must-revalidate\u0027, true);\n        $response-\u003eheaders-\u003eaddCacheControlDirective(\u0027no-store\u0027, true);\n    }\n}\n```\n\nAfter that register service in the container:\n\n```yaml\nservices:\n    App\\EventListener\\CacheControlSubscriber:\n        arguments: [\u0027@sylius.section_resolver.uri_based_section_resolver\u0027]\n        tags:\n            - { name: kernel.event_subscriber, event: kernel.response }\n```\n\nThe code above requires changes in `ShopUriBasedSectionResolver` in order to work. To backport mentioned logic, you need to replace the `Sylius\\Bundle\\ShopBundle\\SectionResolver\\ShopUriBasedSectionResolver` class with:\n\n```php\n\u003c?php\n\ndeclare(strict_types=1);\n\nnamespace App\\SectionResolver;\n\nuse Sylius\\Bundle\\CoreBundle\\SectionResolver\\SectionInterface;\nuse Sylius\\Bundle\\CoreBundle\\SectionResolver\\UriBasedSectionResolverInterface;\nuse Sylius\\Bundle\\ShopBundle\\SectionResolver\\ShopSection;\n\nfinal class ShopUriBasedSectionResolver implements UriBasedSectionResolverInterface\n{\n    /** @var string */\n    private $shopCustomerAccountUri;\n\n    public function __construct(string $shopCustomerAccountUri = \u0027account\u0027)\n    {\n        $this-\u003eshopCustomerAccountUri = $shopCustomerAccountUri;\n    }\n\n    public function getSection(string $uri): SectionInterface\n    {\n        if (str_contains($uri, $this-\u003eshopCustomerAccountUri)) {\n            return new ShopCustomerAccountSubSection();\n        }\n\n        return new ShopSection();\n    }\n}\n```\n\n```yaml\nservices:\n    sylius.section_resolver.shop_uri_based_section_resolver:\n        class: App\\SectionResolver\\ShopUriBasedSectionResolver\n        tags:\n            - { name: sylius.uri_based_section_resolver, priority: -10 }\n```\n\nYou also need to define a new subsection for the Customer Account that is used in the above services:\n\n```php\n\u003c?php\n\ndeclare(strict_types=1);\n\nnamespace App\\SectionResolver;\n\nuse Sylius\\Bundle\\ShopBundle\\SectionResolver\\ShopSection;\n\nclass ShopCustomerAccountSubSection extends ShopSection\n{\n}\n```\n\n### References\n* Originally published at https://huntr.dev/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues)\n* Email us at security@sylius.com\n",
  "id": "GHSA-7563-75j9-6h5p",
  "modified": "2022-03-15T21:47:08Z",
  "published": "2022-03-14T22:26:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/Sylius/security/advisories/GHSA-7563-75j9-6h5p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24742"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Sylius/Sylius"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/Sylius/releases/tag/v1.10.11"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/Sylius/releases/tag/v1.11.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Sylius/Sylius/releases/tag/v1.9.10"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sensitive Information Exposure in Sylius"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.