{"answers":{"affected":"4 open source packages ship an affected version, including @fastify/passport. It affects 1 product.","exploited":"There is no known exploitation of CVE-2023-29019 in the wild and no public exploit code.","fix":"Upgrade @fastify/passport to a fixed version for your release line: 1.1.0 or 2.3.0.","what":"CVE-2023-29019 is a high-severity authentication bypass vulnerability in fastify-passport, published on 21 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2023-29019 and fix it if it is affected.\n\nWhat it is: CVE-2023-29019 is a high-severity authentication bypass vulnerability in fastify-passport, published on 21 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2023-29019 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @fastify/passport (npm): affected all versions; fixed in 1.1.0\n- @fastify/passport (npm): affected all versions; fixed in 1.1.0\n- @fastify/passport (npm): affected from 2.0.0; fixed in 2.3.0\n- @fastify/passport (npm): affected from 2.0.0; fixed in 2.3.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2023-29019/ (Markdown: https://insights.sbomify.com/CVE-2023-29019/index.md)","id":"CVE-2023-29019","markdown":"https://insights.sbomify.com/CVE-2023-29019/index.md","name":"CVE-2023-29019","record":{"aliases":["GHSA-4m3m-ppvx-xgw9"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"Fastify authentication library","requires_auth":"none","summary":"Attackers can hijack user sessions by fixing the session ID before login, allowing account takeover in applications using fastify-passport.","user_interaction":"required","vuln_class":"auth_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"passport","vendor":"fastify"}],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-384","name":"Session Fixation"}],"description":"@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid `sessionId` cookie in the victim's browser and waiting for the victim to log in on the website. As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrade. There are no known workarounds for this vulnerability.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Session fixation in fastify-passport","id":"CVE-2023-29019","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"auth_bypass","year":"2023"},"n_packages":4,"n_references":3,"next":{"headline":"Cross site request forgery token fixation in fastify-passport","id":"CVE-2023-29020"},"packages":[{"ecosystem":"npm","fixed":["1.1.0"],"introduced":["0"],"last_affected":[],"package":"@fastify/passport","purl":null,"source":"GHSA-4m3m-ppvx-xgw9"},{"ecosystem":"npm","fixed":["1.1.0"],"introduced":["0"],"last_affected":[],"package":"@fastify/passport","purl":"pkg:npm/%40fastify/passport","source":"GHSA-4m3m-ppvx-xgw9"},{"ecosystem":"npm","fixed":["2.3.0"],"introduced":["2.0.0"],"last_affected":[],"package":"@fastify/passport","purl":null,"source":"GHSA-4m3m-ppvx-xgw9"},{"ecosystem":"npm","fixed":["2.3.0"],"introduced":["2.0.0"],"last_affected":[],"package":"@fastify/passport","purl":"pkg:npm/%40fastify/passport","source":"GHSA-4m3m-ppvx-xgw9"}],"prev":{"headline":"OpenFeature Operator vulnerable to Cluster-level Privilege Escalation","id":"CVE-2023-29018"},"products":["fastify-passport"],"published":"2023-04-21","related":[{"cvss_score":6.5,"headline":"Cross site request forgery token fixation in fastify-passport","id":"CVE-2023-29020","kev_date_added":null,"published":"2023-04-21"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2025-02-04","vendors":["fastify"]},"summary":"Attackers can hijack user sessions by fixing the session ID before login, allowing account takeover in applications using fastify-passport.","url":"https://insights.sbomify.com/CVE-2023-29019/"}