Listen to this Post
The vulnerability in authkit-nextjs versions 2.11.0 and below stems from a failure to set appropriate anti-caching HTTP headers on authenticated responses. The library’s authentication middleware did not defensively include headers like `Cache-Control: private, no-cache, no-store` for pages behind user authentication. In deployment environments where a Content Delivery Network (CDN) is configured to cache responses, this omission becomes critical. If an authenticated user’s request for a protected page is cached by the CDN, the entire response, including the `Set-Cookie` header containing their session token, is stored. Subsequent requests from different users for the same resource can then be served this cached response, inadvertently granting the new user access to the original user’s active session. This allows session hijacking. The severity is highly dependent on the infrastructure; Vercel deployments are safe by default unless cache headers are manually overridden.
Platform: AuthKit-NextJS
Version: <=2.11.0
Vulnerability : Session Caching
Severity: Medium
date: 2024
Prediction: Patch available
What Undercode Say:
curl -I http://yourapp.com/protected-route
// Check response headers for missing cache controls
console.log(res.headers.get('Cache-Control'));
Exploit simulation: Repeatedly fetch a protected endpoint
for i in {1..10}; do curl -s http://yourapp.com/api/auth/session | grep set-cookie; done
How Exploit:
Attacker identifies a cached authenticated endpoint. They repeatedly request it, receiving a cached response containing another user’s session cookie. They then use this cookie to hijack the user’s session and gain unauthorized access.
Protection from this CVE
Upgrade to authkit-nextjs version 2.11.1 or higher. Manually review and configure `Cache-Control` headers for all authenticated routes in your application and CDN to prevent public caching. Avoid setting cache headers on sensitive paths.
Impact:
Session hijacking, unauthorized access to user accounts and data, potential privilege escalation depending on the application’s functionality.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
