PT-2023-22091 · Unknown · @Fastify/Passport+1

Pedromigueladao · Published 2023-04-21 · Updated 2023-05-04 · CVE-2023-29019

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions @fastify/passport versions prior to the version that regenerates sessionId upon login

Description Applications using @fastify/passport for user authentication, in combination with @fastify/session as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. The login and user validation are performed by the authenticate function. When executing this function, the sessionId is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid sessionId cookie in the victim's browser and waiting for the victim to log in on the website.

Recommendations As a solution, upgrade to a newer version of @fastify/passport that regenerates sessionId upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. For versions prior to the fixed version, consider disabling the authenticate function until a patch is available, or restrict access to the @fastify/session module to minimize the risk of exploitation.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2023-29019

GHSA-4M3M-PPVX-XGW9

Affected Products

@Fastify/Passport

@Fastify/Session

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/29xxx/CVE-2023-29019.json · Exploit
• https://github.com/fastify/fastify-passport/security/advisories/GHSA-4m3m-ppvx-xgw9 · Vendor Advisory
• https://github.com/fastify/fastify-passport/commit/43c82c321db58ea3e375dd475de60befbfcf2a11 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-29019 · Security Note
• https://osv.dev/vulnerability/GHSA-4m3m-ppvx-xgw9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29019 · Vendor Advisory
• https://github.com/fastify/fastify-passport · Note
• https://owasp.org/www-community/attacks/Session_fixation · Note