Time-Based Information Disclosure Vulnerability in Flow
Summary
GHSA-6pq8-67pw-j6hw: Time-Based Information Disclosure Vulnerability in Flow. Affects neos/flow across 5 version ranges.
>= 2.3.0, < 2.3.16
>= 3.0.0, < 3.0.10
>= 3.1.0, < 3.1.7
>= 3.2.0, < 3.2.7
>= 3.3.0, < 3.3.5
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Flow is an open-source PHP web application framework that provides a comprehensive set of tools and features for building robust and scalable applications. It offers a flexible architecture, powerful dependency injection, and a wide range of components for handling various aspects of web development. However, a vulnerability has been identified in Flow that could potentially lead to the disclosure of sensitive information through timing attacks.
Vulnerability Detail
The PersistedUsernamePasswordProvider in Flow was susceptible to an information disclosure vulnerability based on timing attacks. The issue stemmed from the fact that password hashing was only performed if an account was found, allowing an attacker to determine the existence of an account by measuring the response time. To address this vulnerability, the core of Flow has been modified to ensure that the provider always performs a password comparison, regardless of whether credentials were submitted or not. This prevents timing attacks and enhances the security of the authentication process.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.162.3.16composer require neos/flow:2.3.16 -
>= 3.0.0, < 3.0.103.0.10composer require neos/flow:3.0.10 -
>= 3.1.0, < 3.1.73.1.7composer require neos/flow:3.1.7 -
>= 3.2.0, < 3.2.73.2.7composer require neos/flow:3.2.7 -
>= 3.3.0, < 3.3.53.3.5composer require neos/flow:3.3.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is essential to update to the patched versions mentioned above to address the issue effectively.
Conclusion
In conclusion, the Time-Based Information Disclosure Vulnerability in Flow could potentially lead to the disclosure of sensitive information through timing attacks. It is crucial to update the affected versions of Flow to the patched versions mentioned above to mitigate this vulnerability and ensure the security of the application. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for neos/flow →
FAQ
Flow is an open-source PHP web application framework that provides a comprehensive set of tools and features for building robust and scalable applications.
This vulnerability could potentially allow an attacker to determine the existence of user accounts through timing attacks, compromising the confidentiality of sensitive information.
To fix this vulnerability, it is recommended to update the affected versions of Flow to the patched versions: 2.3.16, 3.0.10, 3.1.7, 3.2.7, and 3.3.5.
No, there is no specific workaround available for this vulnerability. Updating to the patched versions is the recommended solution.
You can find more information about this vulnerability in the GitHub advisory database. Please refer to the provided source link for detailed information.
References
Related vulnerabilities
Recent vulnerabilities recorded for neos/flow.
