PT-2018-10212 · Gamerpolls+1 · Gamerpolls+1

Rastating · Published 2018-06-05 · Updated 2018-07-20 · CVE-2018-10966

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GamerPolls version 0.4.6

Description An issue was discovered related to the files config/environments/all.js and config/initializers/02 passport.js. An attacker can edit the Passport.js contents of the session cookie to contain the ID number of the account they wish to take over, and re-sign it using the hard-coded secret.

Recommendations For GamerPolls version 0.4.6, consider disabling the use of the hard-coded secret in config/environments/all.js and config/initializers/02 passport.js as a temporary workaround until a patch is available. Restrict access to editing the Passport.js contents of the session cookie to minimize the risk of exploitation.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2018-10966

Affected Products

Gamerpolls

Passport.Js

References · 5

• 🔥 https://digitalinterruption.com/single-post/2018/06/04/Are-Your-Cookies-Telling-Your-Fortune · Exploit
• https://github.com/GamerPolls/gamerpolls.com/pull/56 · Patch
• https://github.com/GamerPolls/gamerpolls.com/blob/03ccbaf219410e0a45390d0efc12017f08a25282/config/environments/all.js#L58 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-10966 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10966 · Vendor Advisory