Vulnerability · Published May 21, 2024 · Assigned by GitHub_M

CVE-2024-35220@fastify/session reuses destroyed session cookie

High 7.4

In plain English

A high-severity security flaw in session from fastify. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.4%top 61.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

@fastify/session is a session plugin for fastify. Requires the @fastify/cookie plugin. When restoring the cookie from the session store, the `expires` field is overriden if the `maxAge` field was set. This means a cookie is never correctly detected as expired and thus expired sessions are not destroyed. This vulnerability has been patched 10.8.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@fastify/session	10.9.0	GHSA-pj27-2xvp-4qxg

Affected products (as reported)

Vendor	Product	Versions
fastify	session	< 10.9.0

Weakness: CWE-613 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References

https://github.com/fastify/session/security/advisories/GHSA-pj27-2xvp-4qxg x_refsource_CONFIRM
https://github.com/fastify/session/issues/251 x_refsource_MISC
https://github.com/fastify/session/commit/0495ce5b534c4550f25228821db8098293439f2f x_refsource_MISC