CVE-2022-28108: Selenium Server (Grid) CSRF Vulnerability
Summary
CVE-2022-28108: Selenium Server (Grid) CSRF. Affects org.seleniumhq.selenium:selenium-grid versions < 4.0.0-alpha-7. Fixed in 4.0.0-alpha-7. How to fix ↓
Also tracked for
- selenium · PyPI
The same CVE-2022-28108 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Selenium is a widely used open-source framework for automating web applications for testing purposes. It provides a suite of tools and libraries that enable developers to write tests in various programming languages. Selenium Grid is a component that allows for the parallel execution of tests across multiple machines and browsers. However, prior to version 4.0.0, Selenium Server (Grid) was vulnerable to Cross-Site Request Forgery (CSRF) attacks due to its acceptance of non-JSON content types, which could be exploited by malicious actors.
Vulnerability Detail
The vulnerability arises from Selenium Server (Grid) allowing non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain. This permissiveness can lead to CSRF attacks, where an attacker tricks a user into executing unwanted actions on a web application in which they are authenticated. The potential ramifications include unauthorized actions being performed on behalf of the user, leading to data breaches or manipulation of the application state.
How To Fix
Minimum fixed version
4.0.0-alpha-7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement CSRF protection mechanisms in your application, such as using anti-CSRF tokens or validating the content type of incoming requests to ensure they are JSON formatted. However, the best solution is to update to the patched version.
Conclusion
The CSRF vulnerability in Selenium Server (Grid) prior to version 4.0.0 poses significant risks to applications using this framework. It is crucial for developers to update their dependencies to the latest version to protect against potential attacks. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for org.seleniumhq.selenium:selenium-grid →
FAQ
Cross-Site Request Forgery (CSRF) is a type of attack that tricks the victim into submitting a request that they did not intend to make, potentially compromising their account.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
If exploited, this vulnerability can allow attackers to perform unauthorized actions on behalf of authenticated users, leading to data breaches or manipulation of application data.
Yes, you should upgrade to version 4.0.0 or later of both the Selenium Server (Grid) and Selenium Server packages to mitigate this vulnerability.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
