Cross-Site WebSocket Hijacking Vulnerability in python-engineio
Summary
DEBIAN-CVE-2019-13611: An issue was discovered in python-engineio through 3.8.2. Affects python-engineio versions < 3.11.1-1. Fixed in 3.11.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-engineio is a Python library that provides a WebSocket client and server implementation, enabling real-time communication between clients and servers. It is widely used in web applications to facilitate bi-directional communication. The library is designed to be compatible with various transport protocols, making it versatile for developers. However, a security flaw has been identified that exposes users to potential attacks, specifically through the mishandling of the Origin header in WebSocket connections.
Vulnerability Detail
An issue was discovered in python-engineio through version 3.8.2, where a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists. This flaw allows attackers to establish WebSocket connections to a server using a victim's credentials. The vulnerability arises because the Origin header is not adequately restricted, which can lead to unauthorized access and manipulation of WebSocket communications. Attackers can exploit this to impersonate legitimate users, potentially leading to data breaches or unauthorized actions within the application.
How To Fix
Minimum fixed version
3.11.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-engineioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, developers can implement additional checks on the Origin header in their WebSocket server configuration to restrict connections only from trusted origins. This can help mitigate the risk until the package is updated.
Conclusion
The Cross-Site WebSocket Hijacking vulnerability in python-engineio poses significant risks to applications utilizing this library. It is crucial for developers to update to the latest patched version to safeguard against potential exploits. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for python-engineio →
FAQ
The CSWSH vulnerability allows attackers to hijack WebSocket connections, potentially leading to unauthorized access and manipulation of user data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions of python-engineio prior to 3.11.1-1 are affected by this vulnerability.
Yes, you can implement additional checks on the Origin header in your WebSocket server to restrict connections from untrusted origins.
If immediate updates are not possible, ensure to implement workarounds such as restricting the Origin header and monitoring for suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-engineio.
