CVE-2022-35943

Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**. As a workaround: set `Config\Security::$csrfProtection` to `'session,'`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://codeigniter4.github.io/userguide/libraries/security.htm	Broken Link
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite	Third Party Advisory
https://github.com/codeigniter4/shield/security/advisories/GHSA-5hm8-vh6r-2cjq	Exploit Mitigation Third Party Advisory
https://jub0bs.com/posts/2021-01-29-great-samesite-confusion	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:codeigniter:codeigniter::::::::
	cpe:2.3:a:codeigniter:shield:1.0.0:beta::::::

History

No history.

Information

Published : 2022-08-12 21:15

Updated : 2022-08-16 16:06

NVD link : CVE-2022-35943

Mitre link : CVE-2022-35943

CVE.ORG link : CVE-2022-35943

JSON object : View

Products Affected

codeigniter

codeigniter
shield

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2022-35943", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.6}]}, "published": "2022-08-12T21:15:07.803", "references": [{"url": "https://codeigniter4.github.io/userguide/libraries/security.htm", "tags": ["Broken Link"], "source": "security-advisories@github.com"}, {"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/codeigniter4/shield/security/advisories/GHSA-5hm8-vh6r-2cjq", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://jub0bs.com/posts/2021-01-29-great-samesite-confusion", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**. As a workaround: set `Config\\Security::$csrfProtection` to `'session,'`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)"}, {"lang": "es", "value": "Shield es un marco de autenticaci\u00f3n y autorizaci\u00f3n para CodeIgniter 4. Esta vulnerabilidad puede permitir a [Atacantes del Mismo Sitio](https://canitakeyoursubdomain.name/) omitir el mecanismo de [protecci\u00f3n CSRF de CodeIgniter4](https://codeigniter4.github.io/userguide/libraries/security.html) con CodeIgniter Shield. Para que este ataque tenga \u00e9xito, el atacante debe tener control directo (o indirecto, por ejemplo, de tipo XSS) sobre un sitio subdominio (por ejemplo, \"https://a.example.com/\") del sitio objetivo (por ejemplo, \"http://example.com/\"). Actualice a **CodeIgniter versiones v4.2.3 o posteriores** y **Shield versiones v1.0.0-beta.2 o posteriores**. Como mitigaci\u00f3n: establezca \"Config\\Security::$csrfProtection\" como \"\"sesi\u00f3n,\"\"elimine los datos de la sesi\u00f3n antigua justo despu\u00e9s del inicio de sesi\u00f3n (inmediatamente despu\u00e9s de que el ID y la contrase\u00f1a coincidan) y regenere el token CSRF justo despu\u00e9s del inicio de sesi\u00f3n (inmediatamente despu\u00e9s de que el ID y la contrase\u00f1a coincidan)"}], "lastModified": "2022-08-16T16:06:44.540", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBF0023B-014D-4BB0-A3C9-9A73D58C0C15", "versionEndExcluding": "4.2.3"}, {"criteria": "cpe:2.3:a:codeigniter:shield:1.0.0:beta:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1E3F1E0-C2D7-4EC5-AD04-AEB414A3D71C"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}