pglombardo PasswordPusher up to 1.50.3 session fixiation

Summaryinfo

A vulnerability labeled as critical has been found in pglombardo PasswordPusher up to 1.50.3. Affected by this issue is some unknown functionality. Such manipulation leads to session fixiation. This vulnerability is documented as CVE-2024-56733. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in pglombardo PasswordPusher up to 1.50.3 and classified as critical. Affected by this issue is an unknown part. The manipulation with an unknown input leads to a session fixiation vulnerability. Using CWE to declare the problem leads to CWE-384. Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions. Impacted is integrity. CVE summarizes:

Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token is replaced and invalidated upon logout, if an attacker manages to capture the session cookie before this process, they can use the token to gain unauthorized access to the user's session until the token expires or is manually cleared. This vulnerability hinges on the attacker's ability to access the session cookie during an active session, either through a man-in-the-middle attack, by exploiting another vulnerability like XSS, or via direct access to the victim's device. Although there is no direct resolution to this vulnerability, it is recommended to always use the latest version of Password Pusher to best mitigate risk. If self-hosting, ensure Password Pusher is hosted exclusively over SSL connections to encrypt traffic and prevent session cookies from being intercepted in transit. Additionally, implement best practices in local security to safeguard user systems, browsers, and data against unauthorized access.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-56733 since 12/27/2024. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• pglombardo

Name

• PasswordPusher

Version

• 1.50.0
• 1.50.1
• 1.50.2
• 1.50.3

Website

• Product: https://github.com/pglombardo/PasswordPusher/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion