BREACH Vulnerability in ezsystems/ezplatform-http-cache: Potential Secret Exposure via HTTP Compression
Summary
GHSA-mgfg-7533-7jf6: ezsystems/ezplatform-http-cache affected by Breach with Varnish VCL. Affects ezsystems/ezplatform-http-cache versions < 2.3.16. Fixed in 2.3.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ezsystems/ezplatform-http-cache is a caching solution designed for the ezPlatform content management system, enhancing performance by storing frequently accessed data. This package utilizes Varnish VCL templates to manage HTTP requests and responses efficiently. However, it has been found to be susceptible to the BREACH vulnerability, which can compromise sensitive information through HTTP compression.
Vulnerability Detail
The vulnerability arises from the inclusion of Varnish VCL templates that enable compression of API and JSON messages. This can lead to the BREACH attack, where an attacker can exploit HTTP compression to extract secrets from responses by crafting specific requests. Although this is not a direct flaw in the code, the configuration allows for potential data leakage, making it critical to address.
How To Fix
Minimum fixed version
2.3.16
This is the first release that contains the fix.
composer require ezsystems/ezplatform-http-cache:2.3.16Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, disable HTTP compression for REST API requests and any other communications that may contain sensitive information. This can typically be done in your web server configuration settings.
Conclusion
The ezsystems/ezplatform-http-cache package is vulnerable to the BREACH attack due to its use of HTTP compression in Varnish VCL templates. It is crucial to update to the patched version 2.3.16 and disable compression for sensitive communications to mitigate the risk of data exposure.
See every vulnerability recorded for ezsystems/ezplatform-http-cache →
FAQ
BREACH is a type of attack that exploits HTTP compression to extract sensitive data from encrypted responses.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
Failing to address this vulnerability could lead to unauthorized access to sensitive information, potentially compromising user data and security.
Yes, the vulnerability has been patched in version 2.3.16 of the ezsystems/ezplatform-http-cache package.
If an immediate update is not possible, ensure that HTTP compression is disabled for any API requests that may handle sensitive data.
