CVE-2021-31412: Route Enumeration Vulnerability in Vaadin
Summary
CVE-2021-31412: Improper sanitization of path in default RouteNotFoundError view in com.vaadin:flow-server versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1... Affects com.vaadin:vaadin-bom across 3 version ranges.
>= 10.0.0, < 10.0.19
>= 11.0.0, < 14.6.2
>= 15.0.0, < 19.0.9
Fixed in 10.0.19, 14.6.2 or 19.0.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vaadin is an open-source Java framework used for building web applications. It provides a set of user interface components and tools for creating responsive and interactive web interfaces. The Vaadin framework includes a server-side component model and a client-side JavaScript library. This vulnerability affects Vaadin versions 10 to 19 and allows an attacker to enumerate all available routes in production mode.
Vulnerability Detail
The vulnerability arises from improper sanitization of the path in the default RouteNotFoundError view in the com.vaadin:flow-server package. When an application is running in production mode and no custom handler for NotFoundException is provided, a network attacker can send crafted HTTP requests to enumerate all available routes. This can lead to route enumeration and potential information disclosure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.0.0, < 10.0.1910.0.19 -
>= 11.0.0, < 14.6.214.6.2 -
>= 15.0.0, < 19.0.919.0.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading the package is not immediately feasible, a workaround is to provide a custom handler for NotFoundException that does not reveal information about available routes. This can be achieved by creating a custom error view and mapping it to the NotFoundException exception.
Conclusion
The Route Enumeration vulnerability in Vaadin can be mitigated by upgrading the affected package to the fixed versions or implementing the provided workaround. It is important to take action to prevent potential information disclosure and secure the application. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.vaadin:vaadin-bom →
FAQ
Vaadin is an open-source Java framework for building web applications. It provides a set of user interface components and tools for creating responsive and interactive web interfaces.
The vulnerability allows an attacker to enumerate all available routes in a Vaadin application running in production mode. This can potentially lead to information disclosure and aid in further attacks.
To fix this vulnerability, upgrade the com.vaadin:vaadin-bom package to the fixed versions mentioned in the 'how_to_fix' section.
Yes, a workaround is to provide a custom handler for NotFoundException that does not reveal information about available routes. Details of the workaround can be found in the 'workaround' section.
More information about this vulnerability can be found in the official Vaadin security advisory: https://vaadin.com/security/cve-2021-31412
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:vaadin-bom.
