API Platform Core: Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.1.29, 4.2.25, 4.3.8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheKeySafe gate in the JSON:API and HAL item normalizers causes a cross-user attribute leak. #[ApiProperty(security: ...)] is evaluated per request to decide whether a property is exposed. The componentsCache arrays in ApiPlatform\JsonApi\Serializer\ItemNormalizer and ApiPlatform\Hal\Serializer\ItemNormalizer are keyed on $context['cache_key'], which is set unconditionally before delegating to the parent normalizer. The component structure (attributes, relationships, links) computed for one request can therefore be reused for a subsequent request whose user has a different set of accessible properties. A user with lower privileges may end up seeing the structure of properties that the security predicate would otherwise have hidden for them. This issue has been fixed in versions 4.1.29, 4.2.26, and 4.3.12.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- api-platform core
From 2.6.0 · fixed in 4.1.29; From 4.2.0 · fixed in 4.2.25; From 4.3.0 · fixed in 4.3.8
- api-platform api-platform/hal
From 2.6.0 · fixed in 4.1.29; From 4.2.0 · fixed in 4.2.25; From 4.3.0 · fixed in 4.3.8
- api-platform api-platform/json-api
From 2.6.0 · fixed in 4.1.29; From 4.2.0 · fixed in 4.2.25; From 4.3.0 · fixed in 4.3.8
- api-platform/corePackagist
From 2.6.0 · fixed in 4.1.29
- api-platform/corePackagist
From 4.2.0 · fixed in 4.2.25
- api-platform/corePackagist
From 4.3.0 · fixed in 4.3.8
- api-platform/json-apiPackagist
From 4.0.0 · fixed in 4.1.29
- api-platform/json-apiPackagist
From 4.2.0 · fixed in 4.2.25
- api-platform/json-apiPackagist
From 4.3.0 · fixed in 4.3.8
- api-platform/halPackagist
From 4.0.0 · fixed in 4.1.29
- api-platform/halPackagist
From 4.2.0 · fixed in 4.2.25
- api-platform/halPackagist
From 4.3.0 · fixed in 4.3.8