Breach Vulnerability in ibexa/post-install: Potential Secret Exposure via HTTP Compression
Summary
GHSA-4h8f-c635-25p7: ibexa/post-install affected by Breach with Varnish VCL. Affects ibexa/post-install across 2 version ranges.
>= 1.0.0, < 1.0.16
>= 4.6.0, < 4.6.14
Fixed in 1.0.16 or 4.6.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ibexa/post-install package is a tool designed for managing post-installation tasks in the Ibexa content management system. It provides essential functionalities for configuring and optimizing the environment after installation. However, it has been found to include Varnish VCL templates and Apache/Nginx vhost templates that enable HTTP compression, which can lead to security vulnerabilities, particularly the BREACH attack.
Vulnerability Detail
This vulnerability is not a direct flaw in the code but arises from the inclusion of templates that allow for HTTP compression of API and JSON messages. The BREACH vulnerability exploits HTTP compression to potentially extract sensitive information, such as secrets, through specially crafted requests. This can lead to unauthorized access to confidential data, making it critical for users to address this issue promptly.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.161.0.16composer require ibexa/post-install:1.0.16 -
>= 4.6.0, < 4.6.144.6.14composer require ibexa/post-install:4.6.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, ensure that HTTP compression is disabled for REST API requests and any other communications that may contain sensitive information. This can typically be configured in your web server settings, for example:
For Apache
SetEnvIfNoCase Request_URI ^/api/ no-gzip
For Nginx
location /api/ {
gzip off;
}
Conclusion
The ibexa/post-install package has a vulnerability related to HTTP compression that could expose sensitive information through the BREACH attack. Users are advised to update to the patched versions and disable HTTP compression for sensitive communications as a precautionary measure. Regular monitoring for vulnerabilities is essential to maintain application security.
See every vulnerability recorded for ibexa/post-install →
FAQ
The BREACH vulnerability is an attack that exploits HTTP compression to extract sensitive data from encrypted HTTPS responses.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failure to address this vulnerability may lead to unauthorized access to sensitive information, potentially compromising user data and application integrity.
While this specific issue is found in ibexa/post-install, similar vulnerabilities can exist in other packages that enable HTTP compression.
It is recommended to regularly check for vulnerabilities, ideally after each update or at least once a month, to ensure the security of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for ibexa/post-install.
