Ash Framework: Remember-me Session Fixation Bypass (CVSS 9.1)

Vulnerability Key Information Summary Vulnerability Overview Title: Remember-me login guard reads a session key that is never written, enabling session replacement Severity: Critical CVE ID: CVE-2020-10548 CVSS 4.0 Score: 9.1 / 10 Vulnerability Description: Authentication bypass vulnerability in the package. An attacker can plant a remember-me cookie in the victim's browser to replace the victim's authenticated session with the attacker's own account. Root Cause: skips remember-me authentication when the visitor is already authenticated; meanwhile, only writes the key when is enabled. Consequently, the key read by the guard is never written. The guard and the reader disagree on the key's presence, allowing for session replacement. Impact Scope Affected Versions: and Fixed Versions: and Trigger Conditions: The application must have the strategy enabled and be running its per-request plugin; the issue is mitigated if is also enabled. Additional Attacker Requirements: The attacker must be able to plant a cookie in the victim's browser (e.g., via same-origin subdomains, HTTP instead of HTTPS, or shared/cloned browsers). Resolution Upgrade: Upgrade to or . The guard will read the session key in the same manner as the writer, ensuring consistency across all configurations. Temporary Mitigation: Set in the token configuration for authentication resources. This causes to write the key, thereby closing the issue (though this changes the session storage semantics for the entire application, requiring a token for every resource). Related Code / Key Functions The page does not provide a full POC code block, but mentions the following key functions and configurations: References Introduction Commit: Patch Commit (4.x): Patch Commit (5.0):

Goal Reached Thanks to every supporter — we hit 100%!

Ash Framework: Remember-me Session Fixation Bypass (CVSS 9.1)

More from this source