fastify passport fastify session session fixiation

Summaryinfo

A vulnerability labeled as critical has been found in fastify passport. This impacts an unknown function of the component fastify session. Executing a manipulation can lead to session fixiation. The identification of this vulnerability is CVE-2023-29019. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in fastify passport (the affected version unknown). It has been declared as critical. This vulnerability affects an unknown part of the component fastify session. The manipulation with an unknown input leads to a session fixiation vulnerability. The CWE definition for the vulnerability is CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid `sessionId` cookie in the victim's browser and waiting for the victim to log in on the website. As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was shared 04/22/2023 as GHSA-4m3m-ppvx-xgw9. The advisory is shared for download at github.com. This vulnerability was named CVE-2023-29019 since 03/29/2023. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Upgrading eliminates this vulnerability. Applying the patch 43c82c321db58ea3e375dd475de60befbfcf2a11 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• fastify

Name

• passport

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion