critical10.0

CVE-2024-38513

Session Middleware Token Injection Vulnerability

Impact

A security vulnerability has been identified in the Fiber session middleware where a user can supply their own session_id value, leading to the creation of a session with that key. ## Impact The identified vulnerability is a session middleware issue in GoFiber versions 2 and above. This vulnerability allows users to supply their own session_id value, resulting in the creation of a session with that key. If a website relies on the mere presence of a session for security purposes, this can lead to significant security risks, including unauthorized access and session fixation attacks. All users utilizing GoFiber's session middleware in the affected versions are impacted. ## Patches The issue has been addressed in the latest patch. Users are strongly encouraged to upgrade to version 2.52.5 or higher to mitigate this vulnerability. ## Workarounds Users who are unable to upgrade immediately can apply the following workarounds to reduce the risk: 1. **Validate Session IDs**: Implement additional validation to ensure session IDs are not supplied by the user and are securely generated by the server. 2. **Session Management**: Regularly rotate session IDs and enforce strict session expiration policies. ## References For more information on session best practices: - [OWASP Session Management Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html) Users are encouraged to review these references and take immediate action to secure their applications.

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/gofiber/fiber`	<= 2.52.4	2.52.5
go	`github.com/gofiber/fiber/v2`	<= 2.52.4	2.52.5
go	`github.com/gofiber/fiber/v2/middleware/session`	<= 2.52.4	2.52.5

Affected products

Vendor	Product	Affected versions
Gofiber	Fiber	before 2.52.5

Weakness classification

CWE-384