Executive brief
The csrf-csrf library, used to protect web applications against cross-site request forgery (CSRF) attacks, used an incorrect cookie prefix by default. The library named cookies with "Host__" instead of the security-standard "__Host-" prefix. This misconfiguration weakened the security guarantee that cookies originate from the correct domain, potentially allowing cookies to be sent with requests to unintended domains in certain scenarios.
Technical details
This vulnerability is a configuration error in the default cookie naming scheme used for CSRF token protection. The library used the prefix "Host__" instead of the standard "__Host-" prefix defined in OWASP guidelines for cookie security. The __Host- prefix provides additional security by ensuring that when no domain option is specified in cookie options, the cookie can only be sent over HTTPS and is restricted to the current host, preventing subdomain attacks. The vulnerability affects all versions prior to 2.2.1 and is fixed in version 2.2.1 onwards. Users unable to upgrade can work around the issue by manually specifying a custom cookieName with the correct "__Host-" prefix in the library options.
Affected products
- Psifi Solutions csrf-csrf <2.2.1
Timeline
- 2022-10-10: disclosed
- 2022-10-10: patched: Fixed in version 2.2.1