Centrifugal
Monthly
Authentication bypass in Centrifugo real-time messaging server before 6.9.0 lets a remote client spoof trusted proxy headers by populating the client-controlled protocol.ConnectRequest.headers map, which Centrifugo copies and forwards to backend proxies as trusted headers or gRPC metadata. When a backend relies on a header such as x-trusted-user for authentication or authorization, an attacker can impersonate arbitrary users across connect, refresh, subscribe, publish, and RPC proxy calls. Rated CVSS 9.1 (high confidentiality and integrity impact); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Uncontrolled memory and CPU exhaustion in Centrifugo real-time messaging server before 6.8.4 lets unauthenticated attackers send a small compressed WebSocket frame to the unidirectional transport that inflates into a massive decompressed payload. The message_size_limit was only checked against compressed wire bytes, while decompressed output was read via io.ReadAll with no cap, enabling a classic decompression bomb denial of service. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
SSRF in Centrifugo real-time messaging before 6.7.0.
Authentication bypass in Centrifugo real-time messaging server before 6.9.0 lets a remote client spoof trusted proxy headers by populating the client-controlled protocol.ConnectRequest.headers map, which Centrifugo copies and forwards to backend proxies as trusted headers or gRPC metadata. When a backend relies on a header such as x-trusted-user for authentication or authorization, an attacker can impersonate arbitrary users across connect, refresh, subscribe, publish, and RPC proxy calls. Rated CVSS 9.1 (high confidentiality and integrity impact); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Uncontrolled memory and CPU exhaustion in Centrifugo real-time messaging server before 6.8.4 lets unauthenticated attackers send a small compressed WebSocket frame to the unidirectional transport that inflates into a massive decompressed payload. The message_size_limit was only checked against compressed wire bytes, while decompressed output was read via io.ReadAll with no cap, enabling a classic decompression bomb denial of service. No public exploit is identified at time of analysis, and the issue is not listed in CISA KEV.
SSRF in Centrifugo real-time messaging before 6.7.0.