GitHub Advisoryadvisory · Hex

GHSA-3cjh-p6pw-jhv9 Pow Mnesia cache doesn't invalidate all expired keys on startup

MEDIUM Published 2023-09-19 Modified 2023-09-19 Official page ↗
Aliases
CVE-2023-42446
Ecosystem
Hex
Packages
pow
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-298, CWE-672
Reviewed
2023-09-19

Affected packages

• Hex pow: >= 1.0.14, < 1.0.34 → fixed in 1.0.34

Description

Use of `Pow.Store.Backend.MnesiaCache` is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A cache key may become expired when all `Pow.Store.Backend.MnesiaCache` instances have been shut down for a period that is longer than the keys' remaining TTL and the expired key won't be invalidated on startups. Workarounds The expired keys, including all expired sessions, can be manually invalidated by running: ```elixir :mnesia.sync_transaction(fn -> Enum.each(:mnesia.dirty_select(Pow.Store.Backend.MnesiaCache, [{{Pow.Store.Backend.MnesiaCache, :_, :_}, [], [:"$_"]}]), fn {_, key, {_value, expire}} -> ttl = expire - :os.system_time(:millisecond) if ttl < 0, do: :mnesia.delete({Pow.Store.Backend.MnesiaCache, key}) end) end) ``` References https://github.com/pow-auth/pow/commit/15dc525be03c466daa5d2119ca7acdec7b24ed17 https://github.com/pow-auth/pow/issues/713 https://github.com/pow-auth/pow/pull/714

Related

Alias · CVE (1)

  • CVE-2023-42446 Pow is a authentication and user management solution for Phoenix and Plug-based apps. vulnerability

Weakness · CWE (2)

  • CWE-298 Improper Validation of Certificate Expiration weakness
  • CWE-672 Operation on a Resource after Expiration or Release weakness

References