Potentially sensitive data exposure in Symfony Web Socket Bundle (GHSA-wwgf-3xp7-cxj4)
Summary
GHSA-wwgf-3xp7-cxj4: Potentially sensitive data exposure in Symfony Web Socket Bundle. Affects gos/web-socket-bundle across 3 version ranges.
< 1.10.4
>= 2.0.0, < 2.6.1
>= 3.0.0, < 3.3.0
Fixed in 1.10.4, 2.6.1 or 3.3.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Symfony Web Socket Bundle is a package that provides WebSocket functionality for Symfony applications. It allows real-time communication between clients and servers using the WebSocket protocol. The bundle includes features such as topic-based message routing and event broadcasting. However, a vulnerability has been discovered in the bundle that could lead to potentially sensitive data exposure.
Vulnerability Detail
The vulnerability exists in the Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::onPublish() method. If the Gos\Bundle\WebSocketBundle\Server\App\Dispatcher\TopicDispatcher::dispatch() method fails, messages can be broadcasted to the related topic without proper authorization. This can occur due to misconfigured topic routes, missing topic implementations, rejected connections, or unhandled exceptions. As a result, sensitive data may be unintentionally broadcasted to the WebSocket server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.10.41.10.4composer require gos/web-socket-bundle:1.10.4 -
>= 2.0.0, < 2.6.12.6.1composer require gos/web-socket-bundle:2.6.1 -
>= 3.0.0, < 3.3.03.3.0composer require gos/web-socket-bundle:3.3.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to upgrade to the fixed versions of the Symfony Web Socket Bundle.
Conclusion
In conclusion, the Symfony Web Socket Bundle is vulnerable to potentially sensitive data exposure. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions of the bundle. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for gos/web-socket-bundle →
FAQ
The vulnerability can result in the unintended broadcast of potentially sensitive data to the WebSocket server.
You can fix this vulnerability by upgrading to version 1.10.4, 2.6.1, or 3.3.0 of the Symfony Web Socket Bundle.
Yes, older versions of the Symfony Web Socket Bundle are affected. It is recommended to upgrade to the fixed versions.
No specific workaround is mentioned for this vulnerability. Upgrading to the fixed versions is the recommended solution.
You can find more information about this vulnerability in the GitHub advisory: https://github.com/GeniusesOfSymfony/WebSocketBundle
