CVE-2024-31999
CVSS 3.1 Score 7.4 of 10 (high)
Details
Summary
CVE-2024-31999 is a vulnerability affecting the '@festify/secure-session' plugin for Fastify. This plugin creates encrypted cookies to store session data, which are then decrypted and used to generate new sessions upon subsequent requests. The issue lies in the session deletion process: when a session is marked for deletion, it is not actually deleted, allowing an attacker with access to the encrypted cookie to continue using it indefinitely. Version 7.3.0 includes a patch to address this vulnerability. As a temporary solution, developers can add a "last update" field to the session, and treat sessions with outdated timestamps as expired.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions