PT-2018-10123 · Node.Js · Express.Js

Rastating · Published 2018-06-05 · Updated 2018-07-20 · CVE-2018-10813

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Dedos-web version 1.0

Description The issue concerns hardcoded cookie and session secrets in the Express.js application, which are visible in the source code. An attacker can exploit this by editing the session cookie contents and re-signing it using the hardcoded secret, potentially leading to privilege escalation due to the use of Passport.js.

Recommendations For Dedos-web version 1.0, consider regenerating and securely storing unique cookie and session secrets to prevent unauthorized access and privilege escalation. As a temporary workaround, restrict access to sensitive areas of the application to minimize the risk of exploitation.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-10813

Affected Products

Express.Js

References · 4

• 🔥 https://digitalinterruption.com/single-post/2018/06/04/Are-Your-Cookies-Telling-Your-Fortune · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-10813 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10813 · Vendor Advisory
• https://github.com/aprendecondedos/dedos-web/pull/1 · Note