Executive brief
express-openid-connect is an authentication middleware for Express.js applications that integrates with Auth0. The library fails to regenerate session identifiers when users log in, allowing attackers to potentially hijack user sessions through session fixation attacks. This could lead to unauthorized access to user accounts if an attacker can trick a user into using a pre-set session cookie.
Technical details
This is a session fixation vulnerability (CWE-384) in express-openid-connect versions 2.3.0 through 2.5.1. The vulnerability occurs when the library does not regenerate the session ID and session cookie upon successful user login when a custom session store is used. An attacker can pre-set a session cookie in a victim's browser, and if the victim logs in without session regeneration, the attacker can reuse the same session ID to gain unauthorized access. The attack requires user interaction (victim must log in) and network-level access to set cookies. The vulnerability is fixed in version 2.5.2 and later.
Affected products
- Auth0 express-openid-connect 2.3.0 to 2.5.1
Timeline
- 2021-12-09: disclosed
- 2021-12-09: patched: Fix available in version 2.5.2