Executive brief
@fastify/oauth2 is a Fastify plugin that handles OAuth2 authentication. In affected versions, the OAuth2 state parameter—which is meant to prevent cross-site request forgery attacks by being unique per user—was statically generated at startup and reused across all user requests. This vulnerability allows attackers to forge valid OAuth2 requests and potentially hijack authentication sessions.
Technical details
The vulnerability is an OAuth2 state parameter reuse issue in @fastify/oauth2 where all versions prior to 7.2.0 generated a single static state parameter at application startup and used it across all user requests. The OAuth2 state parameter should be unique per user and bound to the user's session to prevent CSRF attacks; reusing a static value breaks this protection. The attack requires network access to the OAuth2 flow and does not require authentication. Version 7.2.0 fixes this by generating a unique state parameter for each user, storing it in an HTTP-only, same-site=lax cookie. This fix includes a breaking change to the checkStateFunction API.
Affected products
- Fastify @fastify/oauth2 < 7.2.0
Timeline
- 2023-07-04: disclosed: Advisory published
- 2023-07-04: patched: Fix released in v7.2.0
- 2023-07-06: other: Advisory withdrawn as duplicate of GHSA-g8x5-p9qc-cf95