GHSA-fh7v-q458-7vmw: 
PHP vulnerability analysis and mitigation

The BREACH (Browser Reconnaissance & Exfiltration via Adaptive Compression of Hypertext) vulnerability affects ibexa/http-cache package versions >= 4.6.0 and < 4.6.14. This vulnerability is related to HTTP compression in Varnish VCL templates and Apache/Nginx vhost templates that enable compression of API and JSON messages, potentially allowing secrets to be extracted through carefully crafted requests (Ibexa Advisory, GitHub Advisory).

The vulnerability exploits HTTP-level compression to perform a compression side-channel attack. For an application to be vulnerable, it must be served from a server that uses HTTP-level compression, reflect user input in HTTP response bodies, and reflect secrets (such as CSRF tokens) in HTTP response bodies. The attack is particularly effective against responses that remain mostly the same, as it allows guessing secrets one character at a time. The vulnerability is independent of TLS/SSL versions and works against any cipher suite (BREACH Attack).

The BREACH vulnerability can be exploited with just a few thousand requests and can be executed in under a minute. The attack enables malicious actors to extract secrets through carefully crafted requests, potentially compromising sensitive information transmitted in HTTP responses. The number of requests required depends on the secret size, and the attack is particularly effective as it allows guessing secrets one character at a time (BREACH Attack).

The vulnerability has been patched in version 4.6.14 of ibexa/http-cache. The fix disables compression for API and JSON messages in the Varnish VCL templates. Users should update their Varnish VCL configuration to align with the new templates and ensure HTTP compression is disabled for REST API requests and other communication containing sensitive information. For those unable to update immediately, the workaround is to manually disable HTTP compression for REST API requests and other communication that might contain secrets (GitHub Advisory, Ibexa Docs).