CVE-2019-13611: python-engineio vulnerable to Cross-Site Request Forgery (CSRF)
Summary
CVE-2019-13611: python-engineio vulnerable to Cross-Site Request Forgery (CSRF). Affects python-engineio versions < 3.9.0. Fixed in 3.9.0. How to fix ↓
Also tracked for
- python-engineio · Debian:11
The same CVE-2019-13611 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-engineio is a package available on PyPI that provides WebSocket and long-polling support for Python web applications. It is commonly used in Socket.IO and Engine.IO web servers for client authentication using cookies. However, this package is vulnerable to Cross-Site Request Forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability in python-engineio allows for Cross-Site Request Forgery (CSRF) attacks. This means that an attacker can trick a user into performing unintended actions on a vulnerable web application. In this case, the vulnerability affects Socket.IO and Engine.IO web servers that authenticate clients using cookies. By exploiting this vulnerability, an attacker can perform actions on behalf of the victim user, potentially leading to unauthorized access, data manipulation, or other malicious activities.
How To Fix
Minimum fixed version
3.9.0
This is the first release that contains the fix.
pip install --upgrade "python-engineio==3.9.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating python-engineio is not feasible, an alternative workaround is to avoid using cookies for client authentication. Instead, a CSRF token can be added to the connection URL. This token should be unique for each user session and validated on the server-side to prevent CSRF attacks.
Conclusion
In conclusion, python-engineio is vulnerable to Cross-Site Request Forgery (CSRF) attacks when used in Socket.IO and Engine.IO web servers that authenticate clients using cookies. To mitigate this vulnerability, it is recommended to update to python-engineio version 3.9.0 or later. Alternatively, a workaround is available by avoiding cookie-based authentication and using CSRF tokens in the connection URL. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-engineio →
FAQ
Cross-Site Request Forgery (CSRF) is a type of attack where an attacker tricks a user into performing unintended actions on a vulnerable web application. The attacker can exploit the trust between the user and the application to perform actions on behalf of the user without their consent.
This vulnerability affects python-engineio when it is used in Socket.IO and Engine.IO web servers that authenticate clients using cookies. It allows an attacker to perform CSRF attacks and potentially gain unauthorized access or manipulate data on behalf of the victim user.
The impact of this vulnerability can be significant. An attacker can perform actions on behalf of the victim user, potentially leading to unauthorized access, data manipulation, or other malicious activities. It is important to patch this vulnerability to prevent such attacks.
To fix this vulnerability, it is recommended to update python-engineio to version 3.9.0 or later. This version includes server-side Origin header checks, which help prevent CSRF attacks. By upgrading to the patched version, the vulnerability is mitigated.
Yes, if updating python-engineio is not feasible, an alternative workaround is to avoid using cookies for client authentication. Instead, a CSRF token can be added to the connection URL. This token should be unique for each user session and validated on the server-side to prevent CSRF attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-engineio.
