Sylius up to 1.3.12/1.4.5/1.5.0/1.6.2 ResourceBundle HTTP Header request smuggling

Summaryinfo

A vulnerability was found in Sylius up to 1.3.12/1.4.5/1.5.0/1.6.2. It has been rated as critical. This vulnerability affects unknown code of the component ResourceBundle. The manipulation as part of HTTP Header leads to request smuggling. This vulnerability is documented as CVE-2020-5220. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in Sylius up to 1.3.12/1.4.5/1.5.0/1.6.2. It has been rated as problematic. This issue affects an unknown function of the component ResourceBundle. The manipulation as part of a HTTP Header leads to a request smuggling vulnerability. Using CWE to declare the problem leads to CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API. Anyone exposing an API with ResourceBundle's controller is affected. The vulnerable versions are: <1.3 || >=1.3.0 <=1.3.12 || >=1.4.0 <=1.4.5 || >=1.5.0 <=1.5.0 || >=1.6.0 <=1.6.2. The patch is provided for Sylius ResourceBundle 1.3.13, 1.4.6, 1.5.1 and 1.6.3, but not for any versions below 1.3.

The weakness was released 01/27/2020 (GitHub Repository). It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2020-5220 since 01/02/2020. The exploitation is known to be difficult. The attack may be initiated remotely. The successful exploitation requires a simple authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Applying a patch is able to eliminate this problem.

Entry connected to this vulnerability is available at VDB-149470. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Sylius

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.3.9
• 1.3.10
• 1.3.11
• 1.3.12
• 1.4
• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 1.5.0
• 1.6.0
• 1.6.1
• 1.6.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion