CVE-2022-2818: Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212)
value: Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository cockpit-hq/cockpit prior to 2.2.2.


CWE description: The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
CVSS v3 base score: 8.8
Published: 2022-08-15T11:21Z
Repository: https://github.com/cockpit-hq/cockpit
Language: PHP
Files changed: CHANGELOG.md, modules/App/Controller/Auth.php
Commit date: 2022-08-12 16:54:25 +0200
Commit message: Fix exposing 2FA secret in JWT token on login

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index 570e850c..42418e64 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,10 +2,11 @@
 
 
 ## WIP
 
 - Add `./tower app:update` cli command to update Cockpit to the latest or specific version
+- Fix exposing 2FA secret in JWT token on login
 
 ## 2.2.1 (2022-08-10)
 
 - Fix linked tree content item display resolver
 - Refactor content models index page
diff --git a/modules/App/Controller/Auth.php b/modules/App/Controller/Auth.php
index 246b7416..4aeffb13 100644
--- a/modules/App/Controller/Auth.php
+++ b/modules/App/Controller/Auth.php
@@ -76,25 +76,33 @@ class Auth extends Base {
 
         if ($user) {
 
             if (isset($user['twofa']['enabled']) && $user['twofa']['enabled']) {
 
+                unset($user['twofa']);
+
                 return [
                     'success' => true,
                     'user' => [
                         'name' => $user['name'],
                         'user' => $user['user'],
                         'email' => $user['email'],
-                        'twofa' => $this->helper('jwt')->create($user)
+                        'twofa' => $this->helper('jwt')->create([
+                            '_id'   => $user['_id'],
+                            'user'  => $user['user'],
+                            'name'  => $user['name'],
+                            'email' => $user['email'],
+                            'role'  => $user['role'],
+                        ])
                     ]
                 ];
 
-            } else {
-                // remove twofa settings
-                unset($user['twofa']);
             }
 
+            // remove 2FA settings from user session
+            unset($user['twofa']);
+
             $this->app->trigger('app.user.disguise', [&$user]);
 
             $this->helper('auth')->setUser($user);
             $this->helper('session')->write('app.session.start', time());
 
@@ -138,6 +146,6 @@ class Auth extends Base {
         }
 
         return $this->stop(412);
 
     }
-}
\ No newline at end of file
+}

Vulnerable code:                         'twofa' => $this->helper('jwt')->create($user)
            } else {
                // remove twofa settings
                unset($user['twofa']);
}
Fixed code: - Fix exposing 2FA secret in JWT token on login
                unset($user['twofa']);

                        'twofa' => $this->helper('jwt')->create([
                            '_id'   => $user['_id'],
                            'user'  => $user['user'],
                            'name'  => $user['name'],
                            'email' => $user['email'],
                            'role'  => $user['role'],
                        ])
            // remove 2FA settings from user session
            unset($user['twofa']);

}