| Package | Affected versions | Patched versions |
|---|---|---|
| python-engineio | < 3.9.0 | 3.9.0 |
| python-engineio | ≤ 3.8.2 |
This is a Cross-Site Request Forgery (CSRF) vulnerability. It affects Socket.IO and Engine.IO web servers that authenticate clients using cookies.
python-engineio version 3.9.0 patches this vulnerability by adding server-side Origin header checks.
Do not use cookies for client authentication, or else add a CSRF token to the connection URL.
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free