CVE-2019-13611

Python-engineio (through 3.8.2) allows WebSocket hijacking via unrestricted Origin headers

• CVSS 8.8
• CWE-352 Cross-Site Request Forgery (CSRF)
• Authentication, Authorization, and Session Management
• Remote

An issue was discovered in python-engineio through 3.8.2. There is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability that allows attackers to make WebSocket connections to a server by using a victim's credentials, because the Origin header is not restricted.

CVE

CVE-2019-13611

CWE

CWE-352 Cross-Site Request Forgery (CSRF)

CVSS base score

8.8

Published

2019-07-16

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Insecure Authentication Mechanisms

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update python-engineio to version 3.8.3 or higher.

from flask import Flask
from flask_socketio import SocketIO

app = Flask(__name__)
socketio = SocketIO(app)

@socketio.on('connect')
def handle_connect():
    pass

if __name__ == '__main__':
    socketio.run(app)

from flask import Flask, request, abort
from flask_socketio import SocketIO

app = Flask(__name__)
socketio = SocketIO(app, cors_allowed_origins=[])

@app.before_request
def check_origin():
    origin = request.headers.get('Origin')
    if origin != 'https://your-origin.com':
        abort(403)

@socketio.on('connect')
def handle_connect():
    pass

if __name__ == '__main__':
    socketio.run(app)

@misc{vaitp:cve201913611,
  title        = {{Python-engineio (through 3.8.2) allows WebSocket hijacking via unrestricted Origin headers}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2019},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2019-13611},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2019-13611/}}
}