Cross-Site WebSocket Hijacking Vulnerability in python-engineio
Summary
CVE-2019-13611: An issue was discovered in python-engineio through 3.8.2. Affects python-engineio across 2 version ranges.
< 3.11.1-1
< 09e9be9a50879c1b97c928c0cc7ba96bdcda7133
Fixed in 3.11.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-engineio is a Python library that provides an interface for real-time communication between clients and servers using WebSockets. It is widely used in web applications to facilitate bi-directional communication. The library is designed to be simple and efficient, but it has a vulnerability that allows attackers to exploit WebSocket connections due to improper handling of the Origin header.
Vulnerability Detail
An issue was discovered in python-engineio through version 3.8.2, where a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists. This vulnerability allows attackers to establish WebSocket connections to a server using the credentials of a victim. The root cause is that the Origin header is not adequately restricted, enabling unauthorized access to the WebSocket connections. This can lead to severe consequences, including data theft and unauthorized actions performed on behalf of the victim.
How To Fix
Minimum fixed version
3.11.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-engineioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If an immediate update is not possible, consider implementing additional security measures such as validating the Origin header manually in your application to ensure that only trusted origins can establish WebSocket connections.
Conclusion
The Cross-Site WebSocket Hijacking vulnerability in python-engineio poses significant risks to applications using this library. It is crucial to update to the latest version to mitigate these risks. Additionally, implementing manual checks on the Origin header can provide temporary relief until an update is applied.
See every vulnerability recorded for python-engineio →
FAQ
Cross-Site WebSocket Hijacking (CSWSH) is a type of attack where an attacker can use a victim's credentials to establish a WebSocket connection to a server, potentially leading to unauthorized access and data exposure.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your manifest file.
The consequences can include unauthorized access to sensitive data, the ability to perform actions on behalf of the victim, and potential data breaches.
Yes, you can implement manual validation of the Origin header to restrict WebSocket connections to trusted sources as a temporary workaround.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-engineio.
