{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-31999", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-08T13:48:37.492Z", "datePublished": "2024-04-10T21:59:54.176Z", "dateUpdated": "2024-08-02T01:59:50.856Z"}, "containers": {"cna": {"title": "@fastify/secure-session: Reuse of destroyed secure session cookie", "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "lang": "en", "description": "CWE-613: Insufficient Session Expiration", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/fastify/fastify-secure-session/security/advisories/GHSA-9wwp-q7wq-jx35", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/fastify/fastify-secure-session/security/advisories/GHSA-9wwp-q7wq-jx35"}, {"name": "https://github.com/fastify/fastify-secure-session/commit/56d66642ecc633cff0606927601e81cdac361370", "tags": ["x_refsource_MISC"], "url": "https://github.com/fastify/fastify-secure-session/commit/56d66642ecc633cff0606927601e81cdac361370"}], "affected": [{"vendor": "fastify", "product": "fastify-secure-session", "versions": [{"version": "< 7.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-10T21:59:54.176Z"}, "descriptions": [{"lang": "en", "value": "@festify/secure-session creates a secure stateless cookie session for Fastify. At the end of the request handling, it will encrypt all data in the session with a secret key and attach the ciphertext as a cookie value with the defined cookie name. After that, the session on the server side is destroyed. When an encrypted cookie with matching session name is provided with subsequent requests, it will decrypt the ciphertext to get the data. The plugin then creates a new session with the data in the ciphertext. Thus theoretically the web instance is still accessing the data from a server-side session, but technically that session is generated solely from a user provided cookie (which is assumed to be non-craftable because it is encrypted with a secret key not known to the user). The issue exists in the session removal process. In the delete function of the code, when the session is deleted, it is marked for deletion. However, if an attacker could gain access to the cookie, they could keep using it forever. Version 7.3.0 contains a patch for the issue. As a workaround, one may include a \"last update\" field in the session, and treat \"old sessions\" as expired."}], "source": {"advisory": "GHSA-9wwp-q7wq-jx35", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-31T17:54:07.860415Z", "id": "CVE-2024-31999", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-31T17:54:23.641Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:59:50.856Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/fastify/fastify-secure-session/security/advisories/GHSA-9wwp-q7wq-jx35", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/fastify/fastify-secure-session/security/advisories/GHSA-9wwp-q7wq-jx35"}, {"name": "https://github.com/fastify/fastify-secure-session/commit/56d66642ecc633cff0606927601e81cdac361370", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/fastify/fastify-secure-session/commit/56d66642ecc633cff0606927601e81cdac361370"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-31999", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-31T17:54:07.860415Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-31T17:54:17.237Z"}}], "cna": {"title": "@fastify/secure-session: Reuse of destroyed secure session cookie", "source": {"advisory": "GHSA-9wwp-q7wq-jx35", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "fastify", "product": "fastify-secure-session", "versions": [{"status": "affected", "version": "< 7.3.0"}]}], "references": [{"url": "https://github.com/fastify/fastify-secure-session/security/advisories/GHSA-9wwp-q7wq-jx35", "name": "https://github.com/fastify/fastify-secure-session/security/advisories/GHSA-9wwp-q7wq-jx35", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/fastify/fastify-secure-session/commit/56d66642ecc633cff0606927601e81cdac361370", "name": "https://github.com/fastify/fastify-secure-session/commit/56d66642ecc633cff0606927601e81cdac361370", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "@festify/secure-session creates a secure stateless cookie session for Fastify. At the end of the request handling, it will encrypt all data in the session with a secret key and attach the ciphertext as a cookie value with the defined cookie name. After that, the session on the server side is destroyed. When an encrypted cookie with matching session name is provided with subsequent requests, it will decrypt the ciphertext to get the data. The plugin then creates a new session with the data in the ciphertext. Thus theoretically the web instance is still accessing the data from a server-side session, but technically that session is generated solely from a user provided cookie (which is assumed to be non-craftable because it is encrypted with a secret key not known to the user). The issue exists in the session removal process. In the delete function of the code, when the session is deleted, it is marked for deletion. However, if an attacker could gain access to the cookie, they could keep using it forever. Version 7.3.0 contains a patch for the issue. As a workaround, one may include a \"last update\" field in the session, and treat \"old sessions\" as expired."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-10T21:59:54.176Z"}}}, "cveMetadata": {"cveId": "CVE-2024-31999", "state": "PUBLISHED", "dateUpdated": "2024-07-31T17:54:23.641Z", "dateReserved": "2024-04-08T13:48:37.492Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-04-10T21:59:54.176Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "@festify/secure-session creates a secure stateless cookie session for Fastify. At the end of the request handling, it will encrypt all data in the session with a secret key and attach the ciphertext as a cookie value with the defined cookie name. After that, the session on the server side is destroyed. When an encrypted cookie with matching session name is provided with subsequent requests, it will decrypt the ciphertext to get the data. The plugin then creates a new session with the data in the ciphertext. Thus theoretically the web instance is still accessing the data from a server-side session, but technically that session is generated solely from a user provided cookie (which is assumed to be non-craftable because it is encrypted with a secret key not known to the user). The issue exists in the session removal process. In the delete function of the code, when the session is deleted, it is marked for deletion. However, if an attacker could gain access to the cookie, they could keep using it forever. Version 7.3.0 contains a patch for the issue. As a workaround, one may include a \"last update\" field in the session, and treat \"old sessions\" as expired."}, {"lang": "es", "value": "@festify/secure-session crea una sesi\u00f3n segura de cookies sin estado para Fastify. Al final del manejo de la solicitud, cifrar\u00e1 todos los datos de la sesi\u00f3n con una clave secreta y adjuntar\u00e1 el texto cifrado como un valor de cookie con el nombre de cookie definido. Despu\u00e9s de eso, la sesi\u00f3n en el lado del servidor se destruye. Cuando se proporciona una cookie cifrada con un nombre de sesi\u00f3n coincidente en solicitudes posteriores, descifrar\u00e1 el texto cifrado para obtener los datos. Luego, el complemento crea una nueva sesi\u00f3n con los datos en el texto cifrado. Por lo tanto, en teor\u00eda, la instancia web todav\u00eda accede a los datos desde una sesi\u00f3n del lado del servidor, pero t\u00e9cnicamente esa sesi\u00f3n se genera \u00fanicamente a partir de una cookie proporcionada por el usuario (que se supone que no se puede crear porque est\u00e1 cifrado con una clave secreta que el usuario desconoce). El problema existe en el proceso de eliminaci\u00f3n de la sesi\u00f3n. En la funci\u00f3n de eliminaci\u00f3n del c\u00f3digo, cuando se elimina la sesi\u00f3n, se marca para su eliminaci\u00f3n. Sin embargo, si un atacante pudiera obtener acceso a la cookie, podr\u00eda seguir us\u00e1ndola para siempre. La versi\u00f3n 7.3.0 contiene un parche para el problema. Como workaround, se puede incluir un campo de \"\u00faltima actualizaci\u00f3n\" en la sesi\u00f3n y tratar las \"sesiones antiguas\" como vencidas."}], "id": "CVE-2024-31999", "lastModified": "2024-04-11T12:47:44.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-04-10T22:15:07.710", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/fastify/fastify-secure-session/commit/56d66642ecc633cff0606927601e81cdac361370"}, {"source": "security-advisories@github.com", "url": "https://github.com/fastify/fastify-secure-session/security/advisories/GHSA-9wwp-q7wq-jx35"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}