CVE-2023-29020 : What You Need to Know

This article provides detailed information about CVE-2023-29020, a vulnerability related to Cross-Site Request Forgery token fixation in fastify-passport.

Understanding CVE-2023-29020

CVE-2023-29020 involves a security issue in fastify-passport related to Session Fixation and Cross-Site Request Forgery (CSRF).

What is CVE-2023-29020?

CVE-2023-29020 is a vulnerability in the

@fastify/passport

authentication library used in the Fastify ecosystem. The issue allows network and same-site attackers to bypass CSRF protection by fixating pre-authentication tokens and performing CSRF attacks after a user authenticates.

The Impact of CVE-2023-29020

The impact of CVE-2023-29020 is that attackers can exploit the vulnerability to obtain a CSRF token for a pre-session, fixate it in the victim's browser, and perform unauthorized actions after the victim authenticates.

Technical Details of CVE-2023-29020

CVE-2023-29020 has the following technical details:

Vulnerability Description

The vulnerability arises from the failure of

@fastify/passport

to clear the session object upon authentication, allowing CSRF tokens generated before authentication to remain valid.

Affected Systems and Versions

The vulnerability affects

fastify-passport

versions < 1.1.0 and >= 2.0.0, < 2.3.0.

Exploitation Mechanism

Attackers exploit the vulnerability by fixating pre-authentication CSRF tokens in a victim's browser and conducting CSRF attacks post-authentication.

Mitigation and Prevention

To mitigate the CVE-2023-29020 vulnerability, consider the following steps:

Immediate Steps to Take

Upgrade to newer versions of

@fastify/passport

that include configuration options like

clearSessionOnLogin

and

clearSessionIgnoreFields

to enhance session security.

Long-Term Security Practices

Implement secure coding practices and regularly update dependencies to prevent CSRF vulnerabilities.

Patching and Updates

Keep

fastify-passport

updated to the latest version to ensure the latest security patches are applied.