python-engineio vulnerable to Cross-Site Request Forgery (CSRF)

WebSocket cross-origin vulnerability

Impact

This is a Cross-Site Request Forgery (CSRF) vulnerability. It affects Socket.IO and Engine.IO web servers that authenticate clients using cookies.

Patches

python-engineio version 3.9.0 patches this vulnerability by adding server-side Origin header checks.

Workarounds

Do not use cookies for client authentication, or else add a CSRF token to the connection URL.

References

https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html

For more information

If you have any questions or comments about this advisory:

• Open an issue in python-engineio