Skip to content

WebSocket cross-origin vulnerability

Low
miguelgrinberg published GHSA-j3jp-gvr5-7hwq Jul 29, 2019 · 1 comment

Package

No package listed

Affected versions

<= 3.8.2

Patched versions

3.9.0

Description

Impact

This is a Cross-Site Request Forgery (CSRF) vulnerability. It affects Socket.IO and Engine.IO web servers that authenticate clients using cookies.

Patches

python-engineio version 3.9.0 patches this vulnerability by adding server-side Origin header checks.

Workarounds

Do not use cookies for client authentication, or else add a CSRF token to the connection URL.

References

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html

For more information

If you have any questions or comments about this advisory:

Severity

Low

CVE ID

CVE-2019-13611

Weaknesses

No CWEs