Executive brief
@fastify/secure-session is a Fastify plugin that manages encrypted session cookies for web applications. The plugin fails to properly invalidate destroyed sessions, allowing an attacker who obtains a session cookie to reuse it indefinitely even after the server destroys the session. This enables unauthorized access to user data and impersonation of legitimate sessions.
Technical details
The vulnerability is an insufficient session expiration flaw (CWE-613) in how @fastify/secure-session handles session deletion. When a session is destroyed, the plugin marks it for deletion but does not prevent the encrypted cookie from being replayed in future requests. An attacker with access to a valid encrypted session cookie can decrypt and reuse it indefinitely because the server will recreate the session from the cookie contents without checking if the session was previously destroyed. The attack requires user interaction (victim must be tricked into sharing or exposing the cookie) but operates over the network without authentication. The fix, released in v7.3.0, ensures destroyed sessions cannot be replayed by adding temporal validation.
Affected products
- Fastify secure-session before 7.3.0
Timeline
- 2024-04-10: disclosed: Advisory published
- 2024-04-10: patched: Fix released in v7.3.0 (commit 56d6664)