CVE-2014-125048 (published 2023-01-06T13:15Z)

A vulnerability, which was classified as critical, has been found in kassi xingwall. This issue affects some unknown processing of the file app/controllers/oauth.js. The manipulation leads to session fixiation. The patch is named e9f0d509e1408743048e29d9c099d36e0e1f6ae7. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217559.

CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-384
cwe_name: Session Fixation
description: Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
extended_description: 
            Such a scenario is commonly observed when:
            
               A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user.
               An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session.
               The application or container uses predictable session identifiers.
	    
	    In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.
         
         

Fix information:
repo_url: https://github.com/kassi/xingwall
commit_details: repo_url: https://github.com/kassi/xingwall
author: Jan Ahrens
author_date: 2014-11-20 11:32:57+01:00
msg: Regenerate session after XING login to fix "session fixation" vulnerability
repository: repo_url: https://github.com/kassi/xingwall
repo_name: kassi/xingwall
description: Facewall for xing members
repo_language: JavaScript
owner: kassi
file_changes: filename: oauth.js
change_type: ModificationType.MODIFY
diff: @@ -35,52 +35,58 @@ module.exports = function (app, io) {
 
     xingApi.getAccessToken(requestToken.token, requestToken.secret, req.query.oauth_verifier,
       function (error, oauthToken, oauthTokenSecret) {
-        res.cookie('requestToken', null); // delete cookie
-
-        var client = xingApi.client(oauthToken, oauthTokenSecret);
-
-        client.get('/v1/users/me', function (error, response) {
-          var user = JSON.parse(response).users[0];
-
-          Wall.findOne({ _id: req.query.wall_id }).exec()
-            .then(function (wall) {
-
-              var profile = new Profile({
-                userId: user.id,
-                displayName: user.display_name,
-                photoUrls: {
-                  size_128x128: user.photo_urls.size_128x128,
-                  size_256x256: user.photo_urls.size_256x256
-                }
-              }).toObject();
-
-              delete profile._id; // make sure that we don't overwrite the internal _id on an update
-
-              Profile.findOneAndUpdate({ userId: user.id }, profile, { upsert: true }).exec()
-                .then(function (profile) {
-                  wall.profiles.pull(profile._id);
-                  wall.profiles.push(profile._id);
-
-                  wall.save(function (err) {
-                    if (err) {
-                      console.error(err);
-                      res.render('error');
-                    } else {
-                      req.session.user = {
-                        id: profile._id,
-                        oauthToken: oauthToken,
-                        oauthTokenSecret: oauthTokenSecret
-                      };
-
-                      io.emit('profiles:updated');
-                      res.render('oauth/callback', { url: "/walls/" + req.query.wall_id });
-                    }
+        if (error) {
+          console.log(error);
+          res.render('error');
+          return;
+        }
+        req.session.regenerate(function (err) {
+          res.cookie('requestToken', null); // delete cookie
+
+          var client = xingApi.client(oauthToken, oauthTokenSecret);
+
+          client.get('/v1/users/me', function (error, response) {
+            var user = JSON.parse(response).users[0];
+
+            Wall.findOne({ _id: req.query.wall_id }).exec()
+              .then(function (wall) {
+
+                var profile = new Profile({
+                  userId: user.id,
+                  displayName: user.display_name,
+                  photoUrls: {
+                    size_128x128: user.photo_urls.size_128x128,
+                    size_256x256: user.photo_urls.size_256x256
+                  }
+                }).toObject();
+
+                delete profile._id; // make sure that we don't overwrite the internal _id on an update
+
+                Profile.findOneAndUpdate({ userId: user.id }, profile, { upsert: true }).exec()
+                  .then(function (profile) {
+                    wall.profiles.pull(profile._id);
+                    wall.profiles.push(profile._id);
+
+                    wall.save(function (err) {
+                      if (err) {
+                        console.error(err);
+                        res.render('error');
+                      } else {
+                        req.session.user = {
+                          id: profile._id,
+                          oauthToken: oauthToken,
+                          oauthTokenSecret: oauthTokenSecret
+                        };
+
+                        io.emit('profiles:updated');
+                        res.render('oauth/callback', { url: "/walls/" + req.query.wall_id });
+                      }
+                    });
                   });
-                });
-
-            }, function (err) {
-              console.log(err);
-            });
+              }, function (err) {
+                console.log(err);
+              });
+          });
         });
       });
   });

programming_language: JavaScript