Neos Flow Information Disclosure in Entity Security
Summary
GHSA-9cw3-j7wg-jwj8: Neos Flow Information disclosure in entity security. Affects neos/flow across 5 version ranges.
>= 3.0.0, < 3.0.12
>= 3.1.0, < 3.1.10
>= 3.2.0, < 3.2.13
>= 3.3.0, < 3.3.13
>= 4.0.0, < 4.0.6
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Neos Flow is an open-source PHP web application framework that allows developers to build robust and scalable applications. It provides a flexible architecture and a set of powerful features for creating web applications. One of the key components of Neos Flow is the Entity Security, which allows developers to secure entities based on user roles and other user properties. However, a vulnerability has been discovered in the entity security feature that could lead to information disclosure.
Vulnerability Detail
The vulnerability in Neos Flow's entity security feature allows users to see entities that are not intended for them. When using entity security to secure entities based on user properties (e.g., company affiliation), the feature does not work properly with the doctrine query cache. As a result, other users can reuse SQL queries from the cache that were built for different users, leading to information disclosure. This vulnerability affects all versions of Neos Flow starting from version 3.0, where the entity security feature was introduced.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.0.123.0.12composer require neos/flow:3.0.12 -
>= 3.1.0, < 3.1.103.1.10composer require neos/flow:3.1.10 -
>= 3.2.0, < 3.2.133.2.13composer require neos/flow:3.2.13 -
>= 3.3.0, < 3.3.133.3.13composer require neos/flow:3.3.13 -
>= 4.0.0, < 4.0.64.0.6composer require neos/flow:4.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to the latest version is not immediately possible, a workaround for this vulnerability is to disable the doctrine query cache (Flow_Persistence_Doctrine). However, this may impact the performance of the application. It is strongly recommended to update to the fixed versions as soon as possible.
Conclusion
The Neos Flow Information Disclosure vulnerability in the entity security feature can lead to unauthorized access to sensitive information. It is crucial to update Neos Flow to the fixed versions to prevent information disclosure. If immediate update is not possible, disabling the doctrine query cache can serve as a temporary workaround. For further support and guidance, contact DevNack.com.
See every vulnerability recorded for neos/flow →
FAQ
You are affected by this vulnerability if you use Entity Security in custom Flow or Neos applications and have implemented advanced security checks based on user properties. If you only use Entity Security based on roles, you are not affected.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your composer.lock file and the Vulert Playground will analyze it for vulnerabilities.
The vulnerability allows users to see entities that they are not authorized to access. This can lead to unauthorized access to sensitive information and a breach of data privacy.
There are no known exploits for this vulnerability at the moment. However, it is important to update to the fixed versions to prevent any potential exploitation.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for neos/flow.
