GHSA-4m3m-ppvx-xgw9

Suggest an improvement
Source
https://github.com/advisories/GHSA-4m3m-ppvx-xgw9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-4m3m-ppvx-xgw9/GHSA-4m3m-ppvx-xgw9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-4m3m-ppvx-xgw9
Aliases
Published
2023-04-21T22:33:30Z
Modified
2023-11-08T04:12:16.421461Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Session fixation in fastify-passport
Details

Applications using @fastify/passport for user authentication, in combination with @fastify/session as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers.

Details

fastify applications rely on the @fastify/passport library for user authentication. The login and user validation are performed by the authenticate function. When executing this function, the sessionId is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid sessionId cookie in the victim's browser and waiting for the victim to log in on the website.

Fix

As a solution, newer versions of @fastify/passport regenerate sessionId upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session.

Credits

References

Affected packages

npm / @fastify/passport

Package

Name
@fastify/passport
View open source insights on deps.dev
Purl
pkg:npm/%40fastify/passport

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.1.0

npm / @fastify/passport

Package

Name
@fastify/passport
View open source insights on deps.dev
Purl
pkg:npm/%40fastify/passport

Affected ranges

Type
SEMVER
Events
Introduced
2.0.0
Fixed
2.3.0