Executive brief
Volto is a React frontend for the Plone content management system. Due to an outdated react-cookie library dependency, users under high server load conditions can have their authentication tokens replaced with another user's token, granting complete unauthorized access to that user's account and permissions.
Technical details
The vulnerability stems from the use of an outdated version of the react-cookie library in Volto versions 14.0.0-alpha.6 through 14.10.0. Under conditions of high server load, a race condition or token handling bug in the react-cookie library can cause one user's authentication cookie to be replaced with another user's cookie. Attack vector is network-based and requires user interaction (browsing the application); no special privileges are required. While no proven public exploit exists and reproduction has been difficult, the vulnerability can occur randomly in production environments. The fix is available in Volto 15.0.0-alpha.0 and later, which upgrades react-cookie to version 4.1.1 and includes related component changes.
Affected products
- Plone Volto 14.0.0-alpha.6 through 14.10.0
Timeline
- 2022-03-14: disclosed
- 2022-03-14: patched: Fix available in Volto 15.0.0-alpha.0 and later