Description
CometD is a scalable comet implementation for web messaging. In any version prior to 5.0.11, 6.0.6, and 7.0.6, internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels. By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other users' (possibly sensitive) data. By publishing to those channels, a remote user may be able to create/modify/delete other user's data and modify the cluster structure. A fix is available in versions 5.0.11, 6.0.6, and 7.0.6. As a workaround, install a custom `SecurityPolicy` that forbids subscription and publishing to remote, non-Oort, sessions on Oort and Seti channels.
Remediation
References
https://github.com/cometd/cometd/issues/1146
https://github.com/cometd/cometd/security/advisories/GHSA-rjmq-6v55-4rjv
Related Vulnerabilities
CVE-2023-36665 Vulnerability in maven package org.webjars.npm:protobufjs
CVE-2021-44906 Vulnerability in npm package minimist
CVE-2020-8124 Vulnerability in npm package url-parse
CVE-2020-8136 Vulnerability in npm package fastify-multipart
CVE-2017-18352 Vulnerability in npm package rendertron-middleware