CVE-2020-11020 Authentication and extension bypass in Faye

Faye NPM, RubyGem versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It...

Authentication and extension bypass in Faye

On 20 April 2020 it was reported to me that the potential for authentication bypass exists in Faye1's extension system. This vulnerability has existed in the Node.js and Ruby versions of the server since version 0.5.0, when extensions were first introduced, in July 2010. It is patched in versions...

Improper Access Control

Overview faye is a simple pub/sub messaging for the web. Affected versions of this package are vulnerable to Improper Access Control. The Server parses channels in a way that means any channel namespaced under /meta/subscribe will also work as a subscription request. For example if the client sen...

Cross-Site Request Forgery (CSRF)

Overview faye is a simple pub/sub messaging for the web. Affected versions of this package are vulnerable to Cross-Site Request Forgery CSRF. Rosetta Flash alphanum only swf converter can be used as a callback at a JSONP endpoint, and as a result, send data across domains. Remediation Upgrade fay...