CVE-2023-29019
Description
@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affected versions for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to session fixation attacks from network and same-site attackers. fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and same-site attackers can hijack the victim's session by tossing a valid `sessionId` cookie in the victim's browser and waiting for the victim to log in on the website. As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session. Users are advised to upgrade. There are no known workarounds for this vulnerability.
How to fix
- fastify passport1.1.0, 2.3.0 or later
- @fastify/passport1.1.0, 2.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fastify passport | v < 1.1.0, 2.0.0 ≤ v < 2.3.0 | 1.1.0, 2.3.0 |
| @fastify/passportnpm | v < 1.1.0, 2.0.0 ≤ v < 2.3.0 | 1.1.0, 2.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.