Executive brief
fastify-passport is a Node.js library that handles user authentication in Fastify web applications. When a user logs in, the library failed to regenerate the session ID, allowing attackers to hijack authenticated sessions by planting a pre-session cookie and waiting for the victim to log in. This could lead to unauthorized account access and data theft.
Technical details
Session fixation (CWE-384) occurs when an application fails to invalidate and regenerate the session identifier after successful authentication. In fastify-passport, the authenticate function preserved the sessionId between pre-login and authenticated states when used with @fastify/session. An unauthenticated attacker can exploit this by: (1) obtaining a valid sessionId cookie from the application, (2) injecting that cookie into a victim's browser via malicious links or XSS, and (3) waiting for the victim to log in, at which point the attacker's pre-set sessionId becomes authenticated. The attack requires user interaction (the victim must log in) and network or same-site attacker access. Patched versions (1.1.0+ and 2.3.0+) now regenerate the sessionId upon successful authentication, preventing the attacker-controlled cookie from being upgraded.
Affected products
- fastify @fastify/passport <= 1.0.1 and >= 2.0.0 <= 2.2.0
Timeline
- 2023-04-21: disclosed
- 2023-04-21: patched: Versions 1.1.0+ and 2.3.0+ include the fix