CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS
Percentile
49.6%
All versions of @fastify/oauth2 used a statically generated state
parameter at startup time and were used across all requests for all users.
The purpose of the Oauth2 state
parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user’s session in some way that will allow the server to validate it.
v7.2.0 changes the default behavior to store the state
in a cookie with the http-only
and same-site=lax
attributes set. The state is now by default generated for every user.
Note that this contains a breaking change in the checkStateFunction
function, which now accepts the full Request
object.
There are no known workarounds.
auth0.com/docs/secure/attack-protection/state-parameters
github.com/fastify/fastify-oauth2
github.com/fastify/fastify-oauth2/commit/bff756b456cbb769080631af2beb85671ff4c79c
github.com/fastify/fastify-oauth2/releases/tag/v7.2.0
github.com/fastify/fastify-oauth2/security/advisories/GHSA-g8x5-p9qc-cf95
nvd.nist.gov/vuln/detail/CVE-2023-35935