PT-2018-9416 · Aiohttp · Aiohttp-Session

Panagiks · Published 2018-06-26 · Updated 2018-09-13 · CVE-2018-1000519

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions aiohttp-session versions prior to 2.4.0

Description The issue concerns a Session Fixation vulnerability in the load session function for RedisStorage. This can result in Session Hijacking. The attack appears to be exploitable via any method that allows setting session cookies, such as ?session=<> or meta tags and script tags with Set-Cookie.

Recommendations For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the load session function for RedisStorage to minimize the risk of exploitation. Avoid using methods that allow setting session cookies until the issue is resolved.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2018-1000519

GHSA-FPWP-69XV-C67F

PYSEC-2018-80

Affected Products

Aiohttp-Session

References · 10

• 🔥 https://github.com/aio-libs/aiohttp-session/issues/272 · Exploit
• https://osv.dev/vulnerability/GHSA-fpwp-69xv-c67f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000519 · Security Note
• https://osv.dev/vulnerability/PYSEC-2018-80 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000519 · Vendor Advisory
• https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L60 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/aiohttp-session/PYSEC-2018-80.yaml · Note
• https://github.com/aio-libs/aiohttp-session · Note
• https://github.com/aio-libs/aiohttp-session/commit/6b7864004d3442dbcfaf8687f63262c1c629f569 · Note
• https://github.com/advisories/GHSA-fpwp-69xv-c67f · Note