CVE-2019-1000011: Incorrect Access Control in api-platform/core
Summary
CVE-2019-1000011: Incorrect Access Control vulnerability in api-platform/core. Affects api-platform/core across 2 version ranges.
>= 2.2.0, < 2.2.10
>= 2.3.0, < 2.3.6
Fixed in 2.2.10 or 2.3.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The api-platform/core package is a part of the API Platform framework, which is used for building API-driven applications. It provides a set of tools and libraries to simplify the development process and enhance the functionality of APIs. This vulnerability affects versions 2.2.0 to 2.3.5 of the package. The vulnerability allows an authenticated user to delete any resource, even if they are not authorized to do so.
Vulnerability Detail
The vulnerability exists in the GraphQL delete mutations of API Platform. It occurs due to incorrect access control checks, allowing an authenticated user to delete any resource, regardless of their authorization level. This vulnerability can be exploited by an attacker who has valid user credentials. The impact of this vulnerability is that it enables unauthorized deletion of resources, potentially leading to data loss or unauthorized access to sensitive information. The vulnerability has been fixed in version 2.3.6 of the package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.2.102.2.10composer require api-platform/core:2.2.10 -
>= 2.3.0, < 2.3.62.3.6composer require api-platform/core:2.3.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, the api-platform/core package versions 2.2.0 to 2.3.5 are vulnerable to an Incorrect Access Control issue in GraphQL delete mutations. This vulnerability allows an authenticated user to delete any resource, regardless of their authorization level. It is recommended to upgrade to version 2.3.6 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for api-platform/core →
FAQ
The vulnerability allows an authenticated user to delete any resource, even if they are not authorized to do so. This can lead to data loss or unauthorized access to sensitive information.
You can use Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the package.
No, only versions 2.2.0 to 2.3.5 of the package are affected. Version 2.3.6 and later have the vulnerability fixed.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/10/GHSA-974j-wjxx-wggj/GHSA-974j-wjxx-wggj.json).
References
Related vulnerabilities
Recent vulnerabilities recorded for api-platform/core.
