CSRF in Fastify Oauth2
CVE-2023-31999
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it. v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.
Vulnerability class: CSRF (Cross-Site Request Forgery)
EPSS: 0.007 (49.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Fastify Oauth2
- Npm @Fastify/oauth2 — versions v7.2.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- support@hackerone.com (Permissions Required)
- support@hackerone.com (Exploit)
- support@hackerone.com (Release Notes)
Frequently asked questions
- What is CVE-2023-31999?
- CVE-2023-31999 is a high-severity vulnerability in Fastify Oauth2, classified under Cross-Site Request Forgery (CSRF). CVSS score: 8.8/10. Published 2023-07-04.
- How severe is CVE-2023-31999?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2023-31999 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.