Executive brief
Passport is a popular authentication middleware library used to secure user logins in web applications. When users log in or log out, the library regenerates the session instead of properly closing it, which allows attackers to potentially hijack user accounts or maintain unauthorized access through session fixation attacks.
Technical details
This is a session fixation vulnerability (CWE-384) in Passport's session handling logic. When a user authenticates or logs out, the session is regenerated rather than invalidated and closed, leaving the application vulnerable to session fixation attacks. The vulnerability affects all versions before 0.6.0. An attacker can exploit this by pre-generating a known session ID and forcing a user to authenticate with that session, potentially gaining persistent access to the user's account. The fix was merged in PR #900, which addresses session fixation concerns by properly closing sessions on login/logout.
Affected products
- Jared Hanson Passport before 0.6.0
Timeline
- 2022-07-02: disclosed
- 2022-05-20: patched: Fix merged in PR #900