Sensitive Information Leak in API Platform Core - Exception Message Exposure
Summary
CVE-2023-47639: API Platform Core can leak exceptions message that may contain sensitive information. Affects api-platform/core versions >= 3.2.0, < 3.2.5. Fixed in 3.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
API Platform Core is a robust framework designed to facilitate the creation of APIs in PHP. It provides a comprehensive set of tools and features that streamline the development process, including support for various data formats, authentication mechanisms, and error handling. However, a recent vulnerability has been identified that allows sensitive information to be exposed through exception messages in JSON error responses.
Vulnerability Detail
The vulnerability arises from the handling of exception messages that are not classified as HTTP exceptions. In an effort to align with the JSON Problem specification, the framework inadvertently began serializing a broader range of exceptions than before. This change, introduced in a recent pull request, resulted in the exposure of exception messages that may contain sensitive information, while the stack trace is hidden in production environments. This could lead to unauthorized access to sensitive data, making it a moderate risk for applications using affected versions of the package.
How To Fix
Minimum fixed version
3.2.5
This is the first release that contains the fix.
composer require api-platform/core:3.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify your error handling configuration to ensure that sensitive information is not included in the JSON error responses. This can be done by customizing the error response format to exclude exception messages or by implementing a middleware that sanitizes error responses before they are sent to clients.
Conclusion
In summary, the API Platform Core framework has a vulnerability that exposes sensitive information through exception messages in JSON error responses. It is crucial to update to version 3.2.5 or later to mitigate this risk. Implementing workarounds can provide temporary relief until the update can be applied.
See every vulnerability recorded for api-platform/core →
FAQ
The vulnerability has a CVSS score of 5.3, indicating a moderate level of risk.
Versions 3.2.0 to 3.2.4 are impacted by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If an immediate update is not possible, consider implementing a workaround by customizing your error handling to prevent sensitive information from being exposed.
Detailed information can be found in the vulnerability advisory on GitHub or through security-focused platforms.
References
Related vulnerabilities
Recent vulnerabilities recorded for api-platform/core.
