Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNyOGotcG1jaC01ajJo

Internal exception message exposure for login action in Sylius

Internal exception message exposure for login action

Impact

Exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer.

A validation message with the exception details will be presented to the user when one will try to log into the shop.

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

The src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig file should be overridden and lines https://github.com/Sylius/Sylius/blob/1.4/src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig#L13-L17 should be replaced with

        {% if last_error %}
            <div class="ui left aligned basic segment">
                {{ messages.error(last_error.messageKey) }}
            </div>
        {% endif %}

The messageKey field should be used instead of the message.

Permalink: https://github.com/advisories/GHSA-3r8j-pmch-5j2h
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNyOGotcG1jaC01ajJo
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: almost 5 years ago
Updated: almost 2 years ago

CVSS Score: 3.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Identifiers: GHSA-3r8j-pmch-5j2h, CVE-2019-16768
References:

• https://github.com/Sylius/Sylius/security/advisories/GHSA-3r8j-pmch-5j2h
• https://nvd.nist.gov/vuln/detail/CVE-2019-16768
• https://github.com/Sylius/Sylius/commit/be245302dfc594d8690fe50dd47631d186aa945f
• https://github.com/advisories/GHSA-3r8j-pmch-5j2h

Repository: https://github.com/Sylius/Sylius
Blast Radius: 10.1

Affected Packages