CVE-2024-31999
CVSS 3.1 Score 7.4 of 10 (high)
Details
Summary
CVE-2024-31999 is a vulnerability affecting the '@festify/secure-session' plugin for Fastify. This plugin creates encrypted cookies to store session data, which are then decrypted and used to generate new sessions upon subsequent requests. The issue lies in the session deletion process: when a session is marked for deletion, it is not actually deleted, allowing an attacker with access to the encrypted cookie to continue using it indefinitely. Version 7.3.0 includes a patch to address this vulnerability. As a temporary solution, developers can add a "last update" field to the session, and treat sessions with outdated timestamps as expired.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.