CVE-2023-42446

Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expire when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than a session's remaining TTL. Version 1.0.34 contains a patch for this issue. As a workaround, expired keys, including all expired sessions, can be manually invalidated.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pow-auth/pow/issues/713	Exploit Issue Tracking
https://github.com/pow-auth/pow/security/advisories/GHSA-3cjh-p6pw-jhv9	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:powauth:pow:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-09-18 22:15

Updated : 2023-09-22 14:21

NVD link : CVE-2023-42446

Mitre link : CVE-2023-42446

CVE.ORG link : CVE-2023-42446

JSON object : View

Products Affected

powauth

pow

CWE

CWE-672

Operation on a Resource after Expiration or Release

CWE-298

Improper Validation of Certificate Expiration

{"id": "CVE-2023-42446", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2023-09-18T22:15:47.247", "references": [{"url": "https://github.com/pow-auth/pow/issues/713", "tags": ["Exploit", "Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pow-auth/pow/security/advisories/GHSA-3cjh-p6pw-jhv9", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-672"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-298"}]}], "descriptions": [{"lang": "en", "value": "Pow is a authentication and user management solution for Phoenix and Plug-based apps. Starting in version 1.0.14 and prior to version 1.0.34, use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A session may expire when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than a session's remaining TTL. Version 1.0.34 contains a patch for this issue. As a workaround, expired keys, including all expired sessions, can be manually invalidated."}, {"lang": "es", "value": "Pow es una soluci\u00f3n de autenticaci\u00f3n y gesti\u00f3n de usuarios para aplicaciones basadas en Phoenix y Plug. A partir de la versi\u00f3n 1.0.14 y anteriores a la versi\u00f3n 1.0.34, el uso de `Pow.Store.Backend.MnesiaCache` es susceptible de secuestro de sesi\u00f3n ya que las claves caducadas no se invalidan correctamente al inicio. Una sesi\u00f3n puede caducar cuando todas las instancias de `Pow.Store.Backend.MnesiaCache` se han cerrado durante un per\u00edodo superior al TTL restante de una sesi\u00f3n. La versi\u00f3n 1.0.34 contiene un parche para este problema. Como workaround, las claves caducadas, incluidas todas las sesiones caducadas, se pueden invalidar manualmente."}], "lastModified": "2023-09-22T14:21:40.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:powauth:pow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0C454727-43EF-432A-BBE4-528F776FB9BA", "versionEndExcluding": "1.0.34", "versionStartIncluding": "1.0.14"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}