CVE-2018-1000519 aiohttp-session Session Fixation vulnerability
Attackers can hijack user sessions in aiohttp-session RedisStorage by setting session cookies, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-1000519?
CVE-2018-1000519 is a medium-severity authentication bypass vulnerability in n/a, published on 26 Jun 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
aio-libs aiohttp-session contains a Session Fixation vulnerability in load_session function for RedisStorage (see: https://github.com/aio-libs/aiohttp-session/blob/master/aiohttp_session/redis_storage.py#L42) that can result in Session Hijacking. This attack appear to be exploitable via Any method that allows setting session cookies (?session=<>, or meta tags or script tags with Set-Cookie).
Weakness: CWE-384
Which versions are affected by CVE-2018-1000519?
3 open source packages ship an affected version, including aiohttp-session. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aiohttp-session PyPI | All versions | 2.4.0 |
aiohttp-session PyPI | All versions | 2.4.0 |
aiohttp-session PyPI | All versions | 2.4.0 |
Products include Aio-Libs Aiohttp Session.
How do I fix CVE-2018-1000519?
Upgrade aiohttp-session to 2.4.0 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-1000519 being exploited?
There is no known exploitation of CVE-2018-1000519 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-fpwp-69xv-c67f, PYSEC-2018-80.