A vulnerability has been found in aio-libs aiohttp-session up to 2.6.0 and classified as critical. This vulnerability affects the function EncryptedCookieStorage/NaClCookieStorage. The manipulation as part of a Cookie leads to a session expiration vulnerability. The CWE definition for the vulnerability is CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

aio-libs aiohttp-session version 2.6.0 and earlier contains a Other/Unknown vulnerability in EncryptedCookieStorage and NaClCookieStorage that can result in Non-expiring sessions / Infinite lifespan. This attack appear to be exploitable via Recreation of a cookie post-expiry with the same value.

The bug was discovered 10/09/2018. The weakness was released 12/20/2018 (Website). The advisory is available at github.com. This vulnerability was named CVE-2018-1000814 since 12/20/2018. The exploitation appears to be easy. The attack can be initiated remotely. A single authentication is needed for exploitation. Technical details are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 72 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Vendor

• aio-libs

Name

• aiohttp-session

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion