CVE-2020-5289: Open Source Vulnerability in com.yahoo.elide:elide-core
Summary
CVE-2020-5289: Read permissions not enforced for client provided filter expressions in Elide. Affects com.yahoo.elide:elide-core versions < 4.5.14. Fixed in 4.5.14. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The com.yahoo.elide:elide-core package is an open-source library that provides a framework for building secure and efficient APIs. It is commonly used in Java applications to handle data access and filtering. This package is vulnerable to a security issue that allows an attacker to guess and check the value of a model field they do not have direct access to. By constructing filter expressions, the attacker can infer the value of an inaccessible field based on the presence or absence of models in the returned collection.
Vulnerability Detail
The vulnerability arises from a lack of enforcement of read permissions for client-provided filter expressions in Elide. An attacker with read permissions to at least one field in a model can use filter expressions to determine the value of an inaccessible field. For example, an attacker can determine which users have admin roles by constructing a filter expression like filter=role=="Admin". This vulnerability can lead to unauthorized access to sensitive information and potential privilege escalation.
How To Fix
Minimum fixed version
4.5.14
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, a workaround is to adjust the read permissions on existing models. By restricting read permissions on fields with different security levels, the attacker's ability to access and infer the values of inaccessible fields can be limited.
Conclusion
The com.yahoo.elide:elide-core package is vulnerable to a security issue that allows an attacker to guess and check the value of an inaccessible model field. This can lead to unauthorized access to sensitive information and potential privilege escalation. It is crucial to update to Elide version 4.5.14 or later to fix the vulnerability. If immediate updating is not possible, adjusting the read permissions on existing models can provide a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.yahoo.elide:elide-core →
FAQ
The vulnerability allows an attacker to guess and check the value of a model field they do not have direct access to. This can lead to unauthorized access to sensitive information and potential privilege escalation.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file and Vulert will analyze it for open-source vulnerabilities in real-time.
There are currently no known exploits for this vulnerability. However, it is important to address the issue promptly to prevent potential unauthorized access to sensitive information.
Yes, the vulnerability has been fixed in Elide version 4.5.14 and later. It is recommended to update to the latest version of the com.yahoo.elide:elide-core package to address the vulnerability.
While updating to the latest version is the recommended solution, you can mitigate the vulnerability by adjusting the read permissions on existing models. By restricting read permissions on fields with different security levels, the attacker's ability to access and infer the values of inaccessible fields can be limited.
