CVE-2023-4649 (published 2023-08-31T01:15Z)

Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.

CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-384
cwe_name: Session Fixation
description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
extended_description: 
            Such a scenario is commonly observed when:
            
               A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user.
               An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session.
               The application or container uses predictable session identifiers.
	    
	    In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.
         
         

Fix information:
repo_url: https://github.com/instantsoft/icms2
commit_details: repo_url: https://github.com/instantsoft/icms2
author: fuzegit
author_date: 2023-08-16 00:47:41+03:00
msg: Add session regenerate after login & logout. Secure cookie if HTTPS.
close #1473
repository: repo_url: https://github.com/instantsoft/icms2
repo_name: instantsoft/icms2
description: Self-hosted Site Management System
repo_language: PHP
owner: instantsoft
file_changes: filename: config.php
change_type: ModificationType.MODIFY
diff: @@ -144,7 +144,7 @@ class cmsConfig extends cmsConfigs {
             $replace_upload_host_protocol = true;
         }
 
-        $this->set('document_root', rtrim(PATH, $this->root));
+        $this->set('document_root', preg_replace('#(.*)('.preg_quote($this->root).')$#u', '$1', PATH . DIRECTORY_SEPARATOR));
         $this->set('root_path', PATH . DIRECTORY_SEPARATOR);
         $this->set('system_path', $this->root_path . 'system/');
         $this->set('upload_path', $this->document_root . $this->upload_root);

programming_language: PHP
filename: user.php
change_type: ModificationType.MODIFY
diff: @@ -265,6 +265,8 @@ class cmsUser {
 
         self::setUserSession($user, $user['ip']);
 
+        self::sessionRegenerate();
+
         return intval($user['id']);
     }
 
@@ -343,6 +345,8 @@ class cmsUser {
         self::getInstance()->id = $user['id'];
         self::getInstance()->is_logged = true;
 
+        self::sessionRegenerate();
+
         return true;
     }
 
@@ -384,6 +388,8 @@ class cmsUser {
 
         self::sessionUnset('user');
 
+        self::sessionRegenerate();
+
         return true;
     }
 
@@ -486,6 +492,19 @@ class cmsUser {
         }
     }
 
+    public static function sessionRegenerate() {
+
+        session_regenerate_id(false);
+
+        $id = session_id();
+
+        session_write_close();
+
+        session_id($id);
+
+        session_start();
+    }
+
     public static function sessionSet($key, $value) {
 
         if (strpos($key, ':') === false) {
@@ -568,7 +587,7 @@ class cmsUser {
                 'path'     => $path,
                 'domain'   => $domain,
                 'samesite' => 'Lax',
-                'secure'   => false,
+                'secure'   => cmsConfig::isSecureProtocol(),
                 'httponly' => $http_only
             ]);
         }

programming_language: PHP