python-engineio vulnerable to Cross-Site Request Forgery (CSRF)
High severity
GitHub Reviewed
Published
Jul 29, 2019
in
miguelgrinberg/python-engineio
•
Updated Jan 11, 2023
Description
Published to the GitHub Advisory Database
Jul 30, 2019
Reviewed
Jun 16, 2020
Last updated
Jan 11, 2023
WebSocket cross-origin vulnerability
Impact
This is a Cross-Site Request Forgery (CSRF) vulnerability. It affects Socket.IO and Engine.IO web servers that authenticate clients using cookies.
Patches
python-engineio version 3.9.0 patches this vulnerability by adding server-side Origin header checks.
Workarounds
Do not use cookies for client authentication, or else add a CSRF token to the connection URL.
References
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html
For more information
If you have any questions or comments about this advisory:
References