CVE-2023-29020 Cross site request forgery token fixation in fastify-passport
Attackers can bypass CSRF protection in fastify-passport by fixing session tokens, allowing unauthorized actions after victim authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-29020?
CVE-2023-29020 is a medium-severity vulnerability in fastify-passport, published on 21 Apr 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport` in affected versions, can be bypassed by network and same-site attackers. `fastify/csrf-protection` implements the synchronizer token pattern (using plugins `@fastify/session` and `@fastify/secure-session`) by storing a random value used for CSRF token generation in the `_csrf` attribute of a user's session. The `@fastify/passport` library does not clear the session object upon authentication, preserving the `_csrf` attribute between pre-login and authenticated sessions. Consequently, CSRF tokens generated before authentication are still valid. Network and same-site attackers can thus obtain a CSRF token for their pre-session, fixate that pre-session in the victim's browser via cookie tossing, and then perform a CSRF attack after the victim authenticates. As a solution, newer versions of `@fastify/passport` include the configuration options: `clearSessionOnLogin (default: true)` and `clearSessionIgnoreFields (default: ['passport', 'session'])` to clear all the session attributes by default, preserving those explicitly defined in `clearSessionIgnoreFields`.
Which versions are affected by CVE-2023-29020?
4 open source packages ship an affected version, including @fastify/passport. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@fastify/passport npm | All versions | 1.1.0 |
@fastify/passport npm | All versions | 1.1.0 |
@fastify/passport npm | From 2.0.0 | 2.3.0 |
@fastify/passport npm | From 2.0.0 | 2.3.0 |
Products include Fastify Passport.
How do I fix CVE-2023-29020?
Upgrade @fastify/passport to a fixed version for your release line: 1.1.0 or 2.3.0.
Is CVE-2023-29020 being exploited?
There is no known exploitation of CVE-2023-29020 in the wild and no public exploit code.
Other vulnerabilities in fastify-passport
Sources
Also known as GHSA-2ccf-ffrj-m4qw.