CVE-2021-31411: Insecure temporary directory usage in Vaadin 14 and 15-19
Summary
CVE-2021-31411: Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19. Affects com.vaadin:vaadin-bom across 2 version ranges.
>= 14.0.3, < 14.5.3
>= 15.0.0, < 19.0.5
Fixed in 14.5.3 or 19.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Vaadin is an open-source Java framework used for building modern web applications. It provides a set of user interface components and tools for creating responsive and interactive web interfaces. The com.vaadin:flow-server package, specifically versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4), is affected by an insecure temporary directory usage vulnerability.
Vulnerability Detail
The vulnerability arises from the insecure usage of temporary directories in the frontend build functionality of Vaadin. Local users can exploit this vulnerability to inject malicious code into frontend resources during application rebuilds. This can lead to various security risks, such as remote code execution, unauthorized access, and data manipulation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 14.0.3, < 14.5.314.5.3 -
>= 15.0.0, < 19.0.519.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately feasible, a temporary workaround is to manually secure the temporary directory used by Vaadin during the frontend build process. This can be done by setting appropriate file system permissions and access controls to prevent unauthorized modification or injection of code into the temporary directory.
Conclusion
Insecure temporary directory usage in Vaadin 14 and 15-19 can lead to the injection of malicious code into frontend resources, posing significant security risks. It is crucial to upgrade to the fixed versions of the com.vaadin:flow-server package or apply the recommended workaround to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.vaadin:vaadin-bom →
FAQ
Vaadin is an open-source Java framework for building web applications with a focus on user interface components and responsive design.
The vulnerability affects Vaadin versions 14.0.3 through 14.5.2, 15.0.0 through 19.0.2, and 19.0.0 through 19.0.4.
The vulnerability can be exploited by local users to inject malicious code into frontend resources, leading to risks such as remote code execution, unauthorized access, and data manipulation.
To fix this vulnerability, upgrade to the fixed versions of the com.vaadin:flow-server package: 14.5.3 or later for Vaadin 14, and 19.0.5 or later for Vaadin 15 through 19.
Yes, if immediate upgrading is not possible, you can secure the temporary directory used by Vaadin during the frontend build process by setting appropriate file system permissions and access controls.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:vaadin-bom.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
