CVE-2021-33604: Reflected cross-site scripting in Vaadin 14, 15-19
Summary
CVE-2021-33604: Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19. Affects com.vaadin:vaadin-bom across 2 version ranges.
>= 14.0.0, < 14.6.2
>= 15.0.0, < 19.0.9
Fixed in 14.6.2 or 19.0.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vaadin is an open-source Java framework used for building web applications. It provides a set of user interface components and tools for creating modern and responsive web interfaces. The Vaadin framework is widely used in enterprise applications and has a large community of developers.
The vulnerability identified as CVE-2021-33604 affects Vaadin versions 14.0.0 through 14.6.1 (Vaadin 14) and versions 15.0.0 through 19.0.8 (Vaadin 15-19). This vulnerability allows a local user to execute arbitrary JavaScript code by opening a crafted URL in a browser. The issue arises due to an URL encoding error in the development mode handler of the com.vaadin:flow-server package.
This vulnerability has a low severity rating with a CVSS score of 2.5.
Vulnerability Detail
The vulnerability in Vaadin allows for reflected cross-site scripting (XSS) attacks. When a user opens a specially crafted URL in a browser, the URL encoding error in the development mode handler fails to properly sanitize the input, allowing an attacker to inject and execute arbitrary JavaScript code within the context of the vulnerable application. This can lead to various security risks, including session hijacking, data theft, and unauthorized actions on behalf of the user.
The vulnerability affects both Vaadin 14 and Vaadin 15-19, making a significant number of applications potentially vulnerable to this attack.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 14.0.0, < 14.6.214.6.2 -
>= 15.0.0, < 19.0.919.0.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can disable the development mode handler in the Vaadin application. This can be done by modifying the application configuration or deployment settings to prevent the handler from being accessible in a production environment. By disabling the development mode handler, the vulnerability can be effectively mitigated. However, it is important to note that this workaround may impact the development and debugging capabilities of the application.
Conclusion
The vulnerability in Vaadin versions 14.0.0 through 14.6.1 (Vaadin 14) and versions 15.0.0 through 19.0.8 (Vaadin 15-19) allows for reflected cross-site scripting attacks. It is crucial for developers using these versions of Vaadin to upgrade to the fixed versions (14.6.2 or later for Vaadin 14, and 19.0.9 or later for Vaadin 15-19) to mitigate the vulnerability. Additionally, disabling the development mode handler can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.vaadin:vaadin-bom →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code within the context of the vulnerable application. This can lead to various security risks, including session hijacking, data theft, and unauthorized actions on behalf of the user.
The vulnerability affects applications that use Vaadin versions 14.0.0 through 14.6.1 (Vaadin 14) and versions 15.0.0 through 19.0.8 (Vaadin 15-19). Developers using these versions of Vaadin should ensure they upgrade to the fixed versions to mitigate the vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it to identify any open-source vulnerabilities, including CVE-2021-33604.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to promptly apply the recommended fixes to mitigate the risk of exploitation.
You can find more information about this vulnerability, including the CVE identifier, on the Vaadin security advisory page: https://vaadin.com/security/cve-2021-33604
References
Related vulnerabilities
Recent vulnerabilities recorded for com.vaadin:vaadin-bom.
