PT-2018-10123 · Node.Js · Express.Js

Rastating · Publicado 2018-06-05 · Atualizado 2018-07-20 · CVE-2018-10813

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dedos-web version 1.0

Description The issue concerns hardcoded cookie and session secrets in the Express.js application, which are visible in the source code. An attacker can exploit this by editing the session cookie contents and re-signing it using the hardcoded secret, potentially leading to privilege escalation due to the use of Passport.js.

Recommendations For Dedos-web version 1.0, consider regenerating and securely storing unique cookie and session secrets to prevent unauthorized access and privilege escalation. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Correção

Using Hardcoded Credentials

Enumeração de Fraquezas

CWE-798

Identificadores relacionados

CVE-2018-10813

Produtos afetados

Express.Js

Referências · 4

• 🔥 https://digitalinterruption.com/single-post/2018/06/04/Are-Your-Cookies-Telling-Your-Fortune · Exploit
• https://github.com/aprendecondedos/dedos-web/pull/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-10813 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-10813 · Aviso do Fabricante