Vulnerability · Published Jul 31, 2020 · Assigned by GitHub_M
CVE-2020-15128Reliance on Cookies without validation in OctoberCMS
Medium 6.1
In plain English
A medium-severity security flaw in october from octobercms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. Issue has been fixed in build 468 (v1.0.468).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | october/rain | 1.0.468 | GHSA-55mm-5399-7r63 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| octobercms | october | < 1.0.468 |
Weakness: CWE-565 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
References
- https://github.com/octobercms/october/security/advisories/GHSA-55mm-5399-7r63 x_refsource_CONFIRM
- https://github.com/octobercms/library/pull/508 x_refsource_MISC
- https://github.com/octobercms/library/commit/28310d4fb336a1741b39498f4474497644a6875c x_refsource_MISC