CVE-2018-25007: Unauthorized client-side property update in Vaadin 10 and 11
Summary
CVE-2018-25007: Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11. Affects com.vaadin:flow-server versions >= 1.0.0, < 1.0.6. Fixed in 1.0.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vaadin is an open-source Java framework used for building modern web applications. It provides a set of user interface components and tools for creating responsive and interactive UIs. The com.vaadin:flow-server package is a part of Vaadin and is responsible for handling client-server communication and rendering UI components on the client-side. This vulnerability affects versions 1.0.0 through 1.0.5 of the com.vaadin:flow-server package, which corresponds to Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2.
Vulnerability Detail
The vulnerability (CVE-2018-25007) in com.vaadin:flow-server allows an attacker to update element property values via a crafted synchronization message. This is possible due to a missing check in the UIDL (UI Description Language) request handler. By exploiting this vulnerability, an attacker can modify property values of UI elements on the client-side, potentially leading to unauthorized actions or information disclosure. The vulnerability has a CVSS score of 2.6, indicating a low severity.
How To Fix
Minimum fixed version
1.0.6
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately feasible, a temporary workaround can be implemented. One possible workaround is to add additional server-side validation for property updates in the affected code. By validating the incoming property values against a whitelist or specific criteria, you can prevent unauthorized modifications. Here's an example of how this can be done in Java:
// Perform additional validation for property updates
if (propertyValueIsValid(newValue)) {
// Update the property value
element.setProperty(propertyName, newValue);
} else {
// Handle invalid property value
log.error("Invalid property value received: {}", newValue);
}
Conclusion
In conclusion, the com.vaadin:flow-server package in Vaadin versions 10 and 11 is vulnerable to unauthorized client-side property updates. This can be exploited by an attacker to modify property values of UI elements, potentially leading to unauthorized actions or information disclosure. To mitigate this vulnerability, it is recommended to upgrade to version 1.0.6 or higher of the com.vaadin:flow-server package. If an immediate upgrade is not possible, implementing server-side validation for property updates can provide temporary protection. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.vaadin:flow-server →
FAQ
This vulnerability allows an attacker to modify property values of UI elements on the client-side. Depending on the application's functionality, this could lead to unauthorized actions or information disclosure.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
While there is no specific known exploit available, the vulnerability allows an attacker to update property values. It is important to fix this vulnerability to prevent potential unauthorized actions or information disclosure.
The recommended mitigation is to upgrade the com.vaadin:flow-server package to version 1.0.6 or higher. If an immediate upgrade is not possible, implementing server-side validation for property updates can provide temporary protection.
You can find more information about this vulnerability, including the CVE identifier (CVE-2018-25007), on the Vaadin Security Advisory page: https://vaadin.com/security/cve-2018-25007
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:flow-server.
