Vulnerability in Vaadin 18-19: Server Session Not Invalidated on Logout
Summary
GHSA-6hgr-2g6q-3rmc: Authentication.logout() helper in com.vaadin:flow-client versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Sec... Affects com.vaadin:flow-client versions >= 5.0.0, < 6.0.5. Fixed in 6.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vaadin is an open-source Java framework used for building modern web applications. The com.vaadin:flow-client package is a part of Vaadin and provides client-side functionality for Vaadin applications. This vulnerability affects versions 5.0.0 to 6.0.4 of the package in Vaadin 18 and 19. The package includes the Authentication.logout() helper method, which is used for logging out users from the application. However, this method uses an incorrect HTTP method, which, when combined with Spring Security CSRF protection, allows local attackers to access Fusion endpoints even after the user has attempted to log out.
Vulnerability Detail
The vulnerability arises from the incorrect HTTP method used by the Authentication.logout() helper method in the com.vaadin:flow-client package. This allows local attackers to bypass the intended session invalidation and gain unauthorized access to Fusion endpoints. The impact of this vulnerability is that an attacker can continue to access sensitive resources and perform actions on behalf of the logged-out user. The vulnerability has a CVSS score of 6.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
6.0.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a workaround can be implemented by manually invalidating the server session after calling the Authentication.logout() method. This can be achieved by adding the following code snippet after the logout call:
VaadinSession.getCurrent().getSession().invalidate();
Conclusion
In conclusion, the com.vaadin:flow-client package in Vaadin 18 and 19 is vulnerable to a session invalidation issue during logout. This allows local attackers to access Fusion endpoints and potentially perform unauthorized actions. It is recommended to upgrade to version 6.0.5 or later of the package to mitigate this vulnerability. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for com.vaadin:flow-client →
FAQ
The vulnerability allows local attackers to access Fusion endpoints even after a user has logged out. This can lead to unauthorized access to sensitive resources and potential misuse of the application.
Versions 5.0.0 to 6.0.4 of the com.vaadin:flow-client package in Vaadin 18 and 19 are affected.
To fix this vulnerability, upgrade to version 6.0.5 or later of the com.vaadin:flow-client package.
Yes, if immediate upgrade is not possible, you can manually invalidate the server session after calling the Authentication.logout() method.
The CVSS score of this vulnerability is 6.3, indicating a moderate severity level.
