PT-2018-9416 · Aiohttp · Aiohttp-Session

Panagiks · Publicado 2018-06-26 · Atualizado 2018-09-13 · CVE-2018-1000519

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions aiohttp-session versions prior to 2.4.0

Description The issue concerns a Session Fixation vulnerability in the load session function for RedisStorage. This can result in Session Hijacking. The attack appears to be exploitable via any method that allows setting session cookies, such as ?session=<> or meta tags and script tags with Set-Cookie.

Recommendations For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the load session function for RedisStorage to minimize the risk of exploitation. Avoid using methods that allow setting session cookies until the issue is resolved.

Exploit

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2018-1000519

GHSA-FPWP-69XV-C67F

PYSEC-2018-80

Produtos afetados

Aiohttp-Session

Referências · 10

• 🔥 https://github.com/aio-libs/aiohttp-session/issues/272 · Exploit
• https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L60 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp-session/PYSEC-2018-80.yaml · Nota
• https://github.com/aio-libs/aiohttp-session · Nota
• https://github.com/aio-libs/aiohttp-session/commit/6b7864004d3442dbcfaf8687f63262c1c629f569 · Nota
• https://osv.dev/vulnerability/GHSA-fpwp-69xv-c67f · Aviso do Fabricante
• https://github.com/advisories/GHSA-fpwp-69xv-c67f · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000519 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2018-80 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000519 · Aviso do Fabricante