easyadmin-extension-bundle action case insensitivity
Summary
GHSA-32rx-xvvr-4xv9: easyadmin-extension-bundle action case insensitivity. Affects alterphp/easyadmin-extension-bundle across 2 version ranges.
>= 1.2.0, < 1.2.11
>= 1.3.0, < 1.3.1
Fixed in 1.2.11 or 1.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The easyadmin-extension-bundle is a package available on Packagist that provides additional functionality for the EasyAdminBundle in Symfony. It enhances the administration interface for managing entities in a web application. The vulnerability in this package relates to the handling of role-based access rules for actions, which are not case sensitive. This can potentially lead to unauthorized access to certain actions within the application.
Vulnerability Detail
The vulnerability in the easyadmin-extension-bundle arises from the lack of case sensitivity in the handling of action names for role-based access rules. This means that an attacker can bypass access restrictions by using different case variations of the action name. For example, if an action is restricted to a specific role, an attacker can access the action by using a different case variation of the action name. This can result in unauthorized access to sensitive functionality or data within the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.2.0, < 1.2.111.2.11composer require alterphp/easyadmin-extension-bundle:1.2.11 -
>= 1.3.0, < 1.3.11.3.1composer require alterphp/easyadmin-extension-bundle:1.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the package to the latest version.
Conclusion
The easyadmin-extension-bundle package is vulnerable to a case insensitivity issue in the handling of action names for role-based access rules. This can lead to unauthorized access to certain actions within the application. To fix this vulnerability, it is recommended to update the package to version 1.3.1 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for alterphp/easyadmin-extension-bundle →
FAQ
The vulnerability allows unauthorized access to certain actions within the application, potentially leading to unauthorized access to sensitive functionality or data.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file and the Vulert Playground will analyze it for any open-source vulnerabilities, including this one.
There are no known exploits for this vulnerability at the moment. However, it is important to patch the vulnerability as soon as possible to prevent any potential unauthorized access.
You can find more details about this vulnerability, including the affected versions and fixed versions, in the advisory on the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-32rx-xvvr-4xv9/GHSA-32rx-xvvr-4xv9.json
To fix this vulnerability, you need to update the easyadmin-extension-bundle package to version 1.3.1 or later. This can be done by updating the package version in your composer.json file and running the composer update command.
