PT-2020-18302 · Hex · Pow

Anschultzer · Published 2020-01-09 · Updated 2022-04-12 · CVE-2020-5205

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Pow (Hex package) versions prior to 1.0.16

Description The use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. This issue does not affect the cookie store, which is commonly used in Phoenix apps.

Recommendations For versions prior to 1.0.16, call Plug.Conn.configure session(conn, renew: true) periodically and after privilege change to mitigate the issue. Consider writing a custom authorization plug where the create/3 method returns the conn only after Plug.Conn.configure session/2 has been called on it. Update to version 1.0.16 or later to resolve the issue.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2020-5205

GHSA-V2WF-C3J6-WPVW

Affected Products

Pow

References · 7

• https://github.com/danschultzer/pow/commit/578ffd3d8bb8e8a26077b644222186b108da474f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-5205 · Security Note
• https://osv.dev/vulnerability/GHSA-v2wf-c3j6-wpvw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5205 · Vendor Advisory
• https://github.com/danschultzer/pow/security/advisories/GHSA-v2wf-c3j6-wpvw · Note
• https://github.com/danschultzer/pow/blob/master/CHANGELOG.md#v1016-2020-01-07 · Note
• https://github.com/danschultzer/pow · Note