Fastly Magento2 Sensitive Information Disclosure
Summary
CVE-2017-13761: Fastly Magento2 sensitive information disclosure. Affects fastly/magento2 versions < 1.2.26. Fixed in 1.2.26. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Fastly Magento2 is a CDN module used with the Magento2 e-commerce platform. It provides caching and content delivery services to improve website performance. The module integrates with third-party authentication plugins to enhance security. However, a vulnerability in versions prior to 1.2.26 allows remote authenticated users to access sensitive information from authenticated sessions through cached redirect responses.
Vulnerability Detail
The vulnerability arises from the caching of redirect responses in the Fastly CDN module. When used with a third-party authentication plugin, authenticated sessions may be cached, potentially exposing sensitive information to remote attackers. This could lead to unauthorized access to user data, compromising the confidentiality of sensitive information.
How To Fix
Minimum fixed version
1.2.26
This is the first release that contains the fix.
composer require fastly/magento2:1.2.26Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the Fastly Magento2 module to the latest version.
Conclusion
The Fastly Magento2 module prior to version 1.2.26 is vulnerable to sensitive information disclosure. It is crucial to update the module to the latest version to mitigate the risk of unauthorized access to sensitive data. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for fastly/magento2 →
FAQ
Fastly Magento2 is a CDN module used with the Magento2 e-commerce platform to improve website performance through caching and content delivery services.
The vulnerability allows remote authenticated users to obtain sensitive information from authenticated sessions, potentially leading to unauthorized access to user data.
To fix this vulnerability, update the Fastly Magento2 module to version 1.2.26 or later.
No, there is no known workaround for this vulnerability. Updating the module to the latest version is the recommended solution.
For more information about this vulnerability, you can refer to the GitHub advisory database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-vpq9-c67q-23fq/GHSA-vpq9-c67q-23fq.json
