Cross-User Attribute Leak in API Platform Core

Compliance Impact

This vulnerability causes a cross-user attribute leak, where sensitive attributes intended to be hidden from users with lower privileges may be exposed due to improper caching in the API Platform Core's JSON:API and HAL item normalizers.

Such unauthorized exposure of sensitive data can lead to violations of data protection regulations and standards like GDPR and HIPAA, which mandate strict controls on access to personal and sensitive information.

Because the flaw allows confidential information to be leaked across users, organizations using affected versions may face compliance risks related to confidentiality and data privacy requirements.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the JSON:API and HAL item normalizers of the api-platform/core library. It is caused by a missing security gate called isCacheKeySafe, which leads to improper caching of user-specific data. Specifically, the cache key used to store normalized data is set before evaluating security predicates that determine if a property should be exposed to a user. As a result, cached data from one user's request, where certain properties were accessible, can be reused for another user's request who should not have access to those properties. This causes a cross-user attribute leak, exposing sensitive information to users with lower privileges.

The issue mainly affects long-running PHP runtimes like FrankenPHP, RoadRunner, or Swoole, where the cache persists across requests. Classic PHP-FPM setups are less vulnerable because the cache does not survive between requests. The vulnerability has been fixed in versions 4.1.29, 4.2.26, and 4.3.12 of the affected packages.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive attributes to users who should not have access to them. A user with lower privileges may see data or properties that are intended to be hidden based on security rules. This cross-user attribute leak compromises confidentiality and can expose sensitive information, potentially leading to privacy violations or data breaches.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability arises from a cache reuse issue in the JSON:API and HAL item normalizers of api-platform/core, where cached data from one user's request may be exposed to another user with lower privileges.

Detection involves verifying if your system is running affected versions of api-platform/core (versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12) and if it uses long-running PHP runtimes such as FrankenPHP, RoadRunner, or Swoole where cache persists across requests.

Since the vulnerability is related to cache key reuse and security predicate evaluation, you can check for unusual attribute leaks between users with different privilege levels by inspecting API responses.

There are no explicit commands provided in the resources to detect this vulnerability automatically.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading the api-platform/core package to a fixed version: 4.1.29, 4.2.26, or 4.3.12 or later.

If upgrading is not immediately possible, workarounds include overriding the normalizer services to implement a security check on the cache key to prevent cache reuse across users.

Another temporary mitigation is to avoid using the #[ApiProperty(security: ...)] attribute on resources served in JSON:API or HAL formats until the patch is applied.

Also, consider the runtime environment: classic PHP-FPM setups are less vulnerable since the cache does not persist between requests, so switching to such an environment may reduce risk temporarily.

Useful 0 Not Useful 0