CVE-2022-31023
MEDIUM5.9EPSS 0.43%Dev error stack trace leaking into prod in Play Framework
描述
### Impact Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception stack trace. Play does this by configuring its `DefaultHttpErrorHandler` to do so based on the application mode. In its Scala API Play also provides a static object `DefaultHttpErrorHandler` that is configured to always show verbose errors. This is used as a default value in some Play APIs, so it is possible to inadvertently use this version in production. It is also possible to improperly configure the `DefaultHttpErrorHandler` object instance as the injected error handler. Both of these situations could result in verbose errors displaying to users in a production application, which could expose sensitive information from the application. In particular the constructor for `CORSFilter` and `apply` method for `CORSActionBuilder` use the static object `DefaultHttpErrorHandler` as a default value. ### Patches This is patched in Play Framework 2.8.16. The `DefaultHttpErrorHandler` object has been changed to use the prod-mode behavior, and `DevHttpErrorHandler` has been introduced for the dev-mode behavior. ### Workarounds When constructing a `CORSFilter` or `CORSActionBuilder`, ensure that a properly-configured error handler is passed. Generally this should be done by using the `HttpErrorHandler` instance provided through dependency injection or through Play's `BuiltInComponents`. Ensure that your application is not using the `DefaultHttpErrorHandler` static object in any code that may be run in production. ### References https://www.playframework.com/documentation/2.8.x/ScalaErrorHandling#Supplying-a-custom-error-handler https://www.playframework.com/documentation/2.8.x/JavaErrorHandling#Supplying-a-custom-error-handler ### For more information If you have any questions or comments about this advisory: * Open an issue in [playframework/playframework](https://github.com/playframework/playframework/) * Email us at [[email protected]](mailto:[email protected])
受影響套件(2)
- Maven/com.typesafe.play:play_2.12from 0, < 2.8.16
- Maven/com.typesafe.play:play_2.13from 0, < 2.8.16
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
參考連結(5)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-31023
- PATCHhttps://github.com/playframework/playframework
- WEBhttps://github.com/playframework/playframework/pull/11305
- WEBhttps://github.com/playframework/playframework/releases/tag/2.8.16
- WEBhttps://github.com/playframework/playframework/security/advisories/GHSA-p9p4-97g9-wcrh