CVE-2023-27495: @fastify/csrf protection Bypass Of CSRF Protection Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qrgf-9gpc-vrxw",
  "modified" : "2023-05-02T12:31:41Z",
  "published" : "2023-04-20T21:18:51Z",
  "aliases" : [ "CVE-2023-27495" ],
  "summary" : "Bypass of CSRF protection in the presence of predictable userInfo",
  "details" : "## Description\nThe [CSRF](https://owasp.org/www-community/attacks/csrf) protection enforced by the `@fastify/csrf-protection` library in combination with `@fastify/cookie` can be bypassed from network and same-site attackers under certain conditions.\n\n`@fastify/csrf-protection` supports an optional `userInfo` parameter that binds the CSRF token to the user. This parameter has been introduced to prevent cookie-tossing attacks as a fix for [CVE-2021-29624](https://www.cvedetails.com/cve/CVE-2021-29624). Whenever `userInfo` parameter is missing, or its value can be predicted for the target user account, network and [same-site](https://canitakeyoursubdomain.name/) attackers can 1. fixate a `_csrf` cookie in the victim's browser, and 2. forge CSRF tokens that are valid for the victim's session. This allows attackers to bypass the CSRF protection mechanism.\n\nAs a fix, `@fastify/csrf-protection` starting from version 6.3.0 (and v4.1.0) includes a server-defined secret `hmacKey` that cryptographically binds the CSRF token to the value of the `_csrf` cookie and the `userInfo` parameter, making tokens non-spoofable by attackers. This protection is effective as long as the `userInfo` parameter is unique for each user.\n\n### Patches\n\nThis is patched in version 6.3.0 and v4.1.0.\n\n### Workarounds\n\nAs a workaround, developers can use a random, non-predictable `userInfo` parameter for each user.\n\n## Credits\n* Pedro Adão (@pedromigueladao), [Instituto Superior Técnico, University of Lisbon](https://tecnico.ulisboa.pt/)\n* Marco Squarcina (@lavish), [Security & Privacy Research Unit, TU Wien](https://secpriv.wien/)",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@fastify/csrf-protection"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.1.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "npm",
      "name" : "@fastify/csrf-protection"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "6.3.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/fastify/csrf-protection/security/advisories/GHSA-qrgf-9gpc-vrxw"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/csrf-protection/security/advisories/GHSA-rc4q-9m69-gqp8"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-27495"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/csrf-protection/commit/be3e5761f37aa05c7c1ac8ed44499c51ecec8058"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/fastify/csrf-protection"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/csrf-protection/releases/tag/v4.1.0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/fastify/csrf-protection/releases/tag/v6.3.0"
  }, {
    "type" : "WEB",
    "url" : "https://www.cvedetails.com/cve/CVE-2021-29624"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-352" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-04-20T21:18:51Z",
    "nvd_published_at" : "2023-04-20T18:15:07Z"
  }
}