326 lines
21 KiB
JSON
326 lines
21 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-110314",
|
|
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "EEF",
|
|
"dateReserved": "2026-10-23T12:45:01.107Z",
|
|
"datePublished": "2026-10-26T13:31:18.257Z",
|
|
"dateUpdated": "2026-11-02T21:00:10.938Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"affected": [
|
|
{
|
|
"collectionURL": "https://repo.hex.pm",
|
|
"cpes": [
|
|
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "bandit",
|
|
"packageURL": "pkg:hex/bandit",
|
|
"product": "bandit",
|
|
"repo": "https://github.com/mtrudel/bandit",
|
|
"vendor": "mtrudel",
|
|
"versions": [
|
|
{
|
|
"lessThan": "1.14.0",
|
|
"status": "affected",
|
|
"version": "0.5.1",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"collectionURL": "https://github.com",
|
|
"cpes": [
|
|
"cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*"
|
|
],
|
|
"defaultStatus": "unaffected",
|
|
"packageName": "mtrudel/bandit",
|
|
"packageURL": "pkg:github/mtrudel/bandit",
|
|
"product": "bandit",
|
|
"repo": "https://github.com/mtrudel/bandit",
|
|
"vendor": "mtrudel",
|
|
"versions": [
|
|
{
|
|
"lessThan": "220b9dfd27f9a21305be2afc75cbe585ddc24e7a",
|
|
"status": "affected",
|
|
"version": "bb407f2277dcb65a58dd8cc07913a0b58a80e266",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"cpeMatch": [
|
|
{
|
|
"criteria": "cpe:2.3:a:mtrudel:bandit:*:*:*:*:*:*:*:*",
|
|
"versionEndExcluding": "1.14.0",
|
|
"versionStartIncluding": "0.5.1",
|
|
"vulnerable": true
|
|
}
|
|
],
|
|
"negate": false,
|
|
"operator": "OR"
|
|
}
|
|
],
|
|
"operator": "AND"
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"type": "reporter",
|
|
"value": "Peter Ullrich"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"type": "remediation developer",
|
|
"value": "Mat Trudel"
|
|
},
|
|
{
|
|
"lang": "en",
|
|
"type": "analyst",
|
|
"value": "Jonatan Männchen / EEF"
|
|
}
|
|
],
|
|
"dateAssigned": "2026-10-23T12:47:59.000Z",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "<p>Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame.</p>\n<p>When a WebSock callback returns <code>{:stop, ...}</code>, <code>Bandit.WebSocket.Connection</code> calls <code>terminate/2</code>, sends Close and shuts down the write side, but keeps the connection process running in a <code>:closing</code> state. <code>handle_frame/3</code> and <code>handle_info/3</code> never check that state, so later frames still reach <code>handle_in/2</code> and later messages reach <code>handle_info/2</code>, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in <code>init/1</code> after a failed token check could still run an admin-only action.</p>\n<p>This issue affects bandit: from 0.5.1 before 1.14.0.</p>"
|
|
},
|
|
{
|
|
"base64": false,
|
|
"type": "text/markdown",
|
|
"value": "Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame.\n\nWhen a WebSock callback returns `{:stop, ...}`, `Bandit.WebSocket.Connection` calls `terminate/2`, sends Close and shuts down the write side, but keeps the connection process running in a `:closing` state. `handle_frame/3` and `handle_info/3` never check that state, so later frames still reach `handle_in/2` and later messages reach `handle_info/2`, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in `init/1` after a failed token check could still run an admin-only action.\n\nThis issue affects bandit: from 0.5.1 before 1.14.0."
|
|
}
|
|
],
|
|
"value": "Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame.\n\nWhen a WebSock callback returns {:stop, ...}, Bandit.WebSocket.Connection calls terminate/2, sends Close and shuts down the write side, but keeps the connection process running in a :closing state. handle_frame/3 and handle_info/3 never check that state, so later frames still reach handle_in/2 and later messages reach handle_info/2, with the state from the stop tuple, until the client sends Close, TCP drops or the idle timeout fires. A client refused in init/1 after a failed token check could still run an admin-only action.\n\nThis issue affects bandit: from 0.5.1 before 1.14.0."
|
|
}
|
|
],
|
|
"impacts": [
|
|
{
|
|
"capecId": "CAPEC-202",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "<p>A remote client that ignores the Close frame can keep invoking a WebSock application's handlers after the application refused or ended its session, bypassing an authorization check in <code>init/1</code> or a kick or ban. This affects WebSock applications that rely on <code>{:stop, ...}</code> to end a session.</p>"
|
|
},
|
|
{
|
|
"base64": false,
|
|
"type": "text/markdown",
|
|
"value": "A remote client that ignores the Close frame can keep invoking a WebSock application's handlers after the application refused or ended its session, bypassing an authorization check in `init/1` or a kick or ban. This affects WebSock applications that rely on `{:stop, ...}` to end a session."
|
|
}
|
|
],
|
|
"value": "A remote client that ignores the Close frame can keep invoking a WebSock application's handlers after the application refused or ended its session, bypassing an authorization check in init/1 or a kick or ban. This affects WebSock applications that rely on {:stop, ...} to end a session."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV4_0": {
|
|
"Automatable": "NOT_DEFINED",
|
|
"Recovery": "NOT_DEFINED",
|
|
"Safety": "NOT_DEFINED",
|
|
"attackComplexity": "LOW",
|
|
"attackRequirements": "PRESENT",
|
|
"attackVector": "NETWORK",
|
|
"baseScore": 6.3,
|
|
"baseSeverity": "MEDIUM",
|
|
"privilegesRequired": "NONE",
|
|
"providerUrgency": "NOT_DEFINED",
|
|
"subAvailabilityImpact": "NONE",
|
|
"subConfidentialityImpact": "NONE",
|
|
"subIntegrityImpact": "NONE",
|
|
"userInteraction": "NONE",
|
|
"valueDensity": "NOT_DEFINED",
|
|
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
|
|
"version": "4.0",
|
|
"vulnAvailabilityImpact": "NONE",
|
|
"vulnConfidentialityImpact": "LOW",
|
|
"vulnIntegrityImpact": "LOW",
|
|
"vulnerabilityResponseEffort": "NOT_DEFINED"
|
|
},
|
|
"format": "CVSS",
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "GENERAL"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"cweId": "CWE-602",
|
|
"description": "CWE-602 Client-Side Enforcement of Server-Side Security",
|
|
"lang": "en",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
|
|
"shortName": "EEF",
|
|
"dateUpdated": "2026-10-26T13:31:18.257Z"
|
|
},
|
|
"references": [
|
|
{
|
|
"name": "WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit",
|
|
"tags": [
|
|
"vendor-advisory",
|
|
"related"
|
|
],
|
|
"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-2v5v-8f9v-xh85"
|
|
},
|
|
{
|
|
"name": "EEF CNA record for CVE-2026-110314",
|
|
"tags": [
|
|
"related"
|
|
],
|
|
"url": "https://cna.erlef.org/cves/CVE-2026-110314.html"
|
|
},
|
|
{
|
|
"name": "OSV record EEF-CVE-2026-110314",
|
|
"tags": [
|
|
"related"
|
|
],
|
|
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-110314"
|
|
},
|
|
{
|
|
"name": "Introducing commit bb407f2 in mtrudel/bandit",
|
|
"tags": [
|
|
"related"
|
|
],
|
|
"url": "https://github.com/mtrudel/bandit/commit/bb407f2277dcb65a58dd8cc07913a0b58a80e266"
|
|
},
|
|
{
|
|
"name": "Fix commit 220b9df in mtrudel/bandit",
|
|
"tags": [
|
|
"patch"
|
|
],
|
|
"url": "https://github.com/mtrudel/bandit/commit/220b9dfd27f9a21305be2afc75cbe585ddc24e7a"
|
|
}
|
|
],
|
|
"source": {
|
|
"discovery": "UNKNOWN"
|
|
},
|
|
"title": "WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit",
|
|
"workarounds": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "<p>Mark the WebSock state as stopped whenever a callback returns <code>{:stop, ...}</code>, and have <code>handle_in/2</code> and <code>handle_info/2</code> return <code>{:ok, state}</code> without acting while that mark is set.</p>"
|
|
},
|
|
{
|
|
"base64": false,
|
|
"type": "text/markdown",
|
|
"value": "Mark the WebSock state as stopped whenever a callback returns `{:stop, ...}`, and have `handle_in/2` and `handle_info/2` return `{:ok, state}` without acting while that mark is set."
|
|
}
|
|
],
|
|
"value": "Mark the WebSock state as stopped whenever a callback returns {:stop, ...}, and have handle_in/2 and handle_info/2 return {:ok, state} without acting while that mark is set."
|
|
}
|
|
],
|
|
"x_proofOfConcept": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "<ol>\n<li>Serve a WebSock whose <code>init/1</code> returns <code>{:stop, :normal, {4401, \"unauthorized\"}, state}</code> for a wrong token, and whose <code>handle_in/2</code> runs an admin-only <code>delete_all_users</code> action when <code>user_id</code> is <code>admin</code>.</li>\n<li>Upgrade with <code>?user_id=admin&token=wrong</code>. The server calls <code>terminate/2</code> and sends a Close frame with code 4401.</li>\n<li>Ignore the Close frame and send a masked text frame <code>delete_all_users</code>.</li>\n<li><code>handle_in/2</code> runs <code>delete_all_users</code> as <code>admin</code>.</li>\n</ol>"
|
|
},
|
|
{
|
|
"base64": false,
|
|
"type": "text/markdown",
|
|
"value": "1. Serve a WebSock whose `init/1` returns `{:stop, :normal, {4401, \"unauthorized\"}, state}` for a wrong token, and whose `handle_in/2` runs an admin-only `delete_all_users` action when `user_id` is `admin`.\n2. Upgrade with `?user_id=admin&token=wrong`. The server calls `terminate/2` and sends a Close frame with code 4401.\n3. Ignore the Close frame and send a masked text frame `delete_all_users`.\n4. `handle_in/2` runs `delete_all_users` as `admin`."
|
|
}
|
|
],
|
|
"value": "* Serve a WebSock whose init/1 returns {:stop, :normal, {4401, \"unauthorized\"}, state} for a wrong token, and whose handle_in/2 runs an admin-only delete_all_users action when user_id is admin.\n* Upgrade with ?user_id=admin&token=wrong. The server calls terminate/2 and sends a Close frame with code 4401.\n* Ignore the Close frame and send a masked text frame delete_all_users.\n* handle_in/2 runs delete_all_users as admin."
|
|
}
|
|
],
|
|
"x_technicalAnalysis": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "<p><strong>1. Stop without close.</strong> In <code>Bandit.WebSocket.Connection</code>, <code>do_stop/4</code> calls <code>terminate/2</code>, sends the Close frame and runs <code>shutdown(:write)</code>. It then returns <code>{:continue, %{connection | state: :closing}}</code>, so <code>Bandit.WebSocket.Handler</code> keeps the process alive.</p>\n<p><strong>2. No state check.</strong> <code>handle_frame/3</code> and <code>handle_info/3</code> never check <code>connection.state</code>. Every later data frame still reaches <code>handle_in/2</code>, and every later message still reaches <code>handle_info/2</code>, with the state from the stop tuple.</p>\n<p><strong>3. Client-controlled lifetime.</strong> The connection ends only when the client sends Close, TCP drops, or the idle timeout fires, and each client frame resets that timeout. All stops through <code>do_stop</code> are affected: <code>{:stop, :normal, ...}</code>, <code>{:stop, {:shutdown, :disconnected}, ...}</code> and <code>{:stop, {:shutdown, :restart}, ...}</code>, which is what Phoenix's <code>:socket_drain</code> returns. A banned user who was kicked kept posting for longer than the idle timeout.</p>"
|
|
},
|
|
{
|
|
"base64": false,
|
|
"type": "text/markdown",
|
|
"value": "**1. Stop without close.** In `Bandit.WebSocket.Connection`, `do_stop/4` calls `terminate/2`, sends the Close frame and runs `shutdown(:write)`. It then returns `{:continue, %{connection | state: :closing}}`, so `Bandit.WebSocket.Handler` keeps the process alive.\n\n**2. No state check.** `handle_frame/3` and `handle_info/3` never check `connection.state`. Every later data frame still reaches `handle_in/2`, and every later message still reaches `handle_info/2`, with the state from the stop tuple.\n\n**3. Client-controlled lifetime.** The connection ends only when the client sends Close, TCP drops, or the idle timeout fires, and each client frame resets that timeout. All stops through `do_stop` are affected: `{:stop, :normal, ...}`, `{:stop, {:shutdown, :disconnected}, ...}` and `{:stop, {:shutdown, :restart}, ...}`, which is what Phoenix's `:socket_drain` returns. A banned user who was kicked kept posting for longer than the idle timeout."
|
|
}
|
|
],
|
|
"value": "1. Stop without close. In Bandit.WebSocket.Connection, do_stop/4 calls terminate/2, sends the Close frame and runs shutdown(:write). It then returns {:continue, %{connection | state: :closing}}, so Bandit.WebSocket.Handler keeps the process alive.\n\n2. No state check. handle_frame/3 and handle_info/3 never check connection.state. Every later data frame still reaches handle_in/2, and every later message still reaches handle_info/2, with the state from the stop tuple.\n\n3. Client-controlled lifetime. The connection ends only when the client sends Close, TCP drops, or the idle timeout fires, and each client frame resets that timeout. All stops through do_stop are affected: {:stop, :normal, ...}, {:stop, {:shutdown, :disconnected}, ...} and {:stop, {:shutdown, :restart}, ...}, which is what Phoenix's :socket_drain returns. A banned user who was kicked kept posting for longer than the idle timeout."
|
|
}
|
|
]
|
|
},
|
|
"adp": [
|
|
{
|
|
"references": [
|
|
{
|
|
"url": "https://github.com/mtrudel/bandit/security/advisories/GHSA-2v5v-8f9v-xh85",
|
|
"tags": [
|
|
"exploit"
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2026-11-02T20:59:44.175690Z",
|
|
"id": "CVE-2026-110314",
|
|
"options": [
|
|
{
|
|
"Exploitation": "poc"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-11-02T21:00:10.938Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |