CVE-2020-11094

Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar

Workarounds

Apply https://github.com/rainlab/debugbar-plugin/commit/86dd29f9866d712de7d98f5f9dc67751b82ecd18 to your installation manually if unable to upgrade to v3.1.0.

For more information

If you have any questions or comments about this advisory:

• Email us at [email protected] & [email protected]

Acknowledgements

Thanks to Freddie Poser for reporting the issue to the RainLab team.

The debugbar contains a perhaps little known feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potential exists for them to use this feature to view all requests being made to the application and obtain sensitive information from those requests. There even exists the potential for account takeovers of authenticated users by non-authenticated public users, which would then lead to a number of other potential issues as an attacker could theoretically get full access to the system if the required conditions existed.

CVE-2020-11094 has a CVSS score of 6.1 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.1.0); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Issue has been patched in v3.1.0 by locking down access to the debugbar to all users; it now requires an authenticated backend user with a specifically enabled permission before it is even usable, and the feature that allows access to stored request information is restricted behind a different permission that's more restrictive.

1. What is CVE-2020-11094? CVE-2020-11094 is a medium-severity security vulnerability in rainlab/debugbar-plugin (composer), affecting versions < 3.1.0. It is fixed in 3.1.0.
2. How severe is CVE-2020-11094? CVE-2020-11094 has a CVSS score of 6.1 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of rainlab/debugbar-plugin are affected by CVE-2020-11094? rainlab/debugbar-plugin (composer) versions < 3.1.0 is affected.
4. Is there a fix for CVE-2020-11094? Yes. CVE-2020-11094 is fixed in 3.1.0. Upgrade to this version or later.
5. Is CVE-2020-11094 exploitable, and should I be worried? Whether CVE-2020-11094 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2020-11094 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2020-11094? Upgrade rainlab/debugbar-plugin to 3.1.0 or later.