Listen to this Post
The vulnerability exists in the multi-session plugin’s `/sign-out` after-hook. The hook retrieves the raw `cookie` header from the request and parses it. It then iterates over all cookie keys, looking for any that match the `_multi-` pattern. For each matching key, it extracts the cookie value. This value, which is expected to be a structured token, is split on the ‘.’ character to isolate the raw session token identifier. Crucially, this extracted token is not validated or verified against a signing secret using ctx.getSignedCookie. The hook passes a list of these unsanitized, attacker-controlled tokens directly to the `internalAdapter.deleteSessions` function. This allows an attacker to forge a cookie containing any session token, causing the victim’s session to be deleted upon the attacker’s sign-out request.
Platform: Better-auth
Version: canary
Vulnerability: Session Revocation
Severity: Critical
date: 2024-XX-XX
Prediction: Patch by 2024-11-15
What Undercode Say:
bun run --conditions better-auth-dev-source PROOF_OF_CONCEPTS/multi_session/force-signout.ts
const cookieHeader = ctx.headers.get("cookie");
const cookies = parseCookies(cookieHeader);
for (const key in cookies) {
if (key.includes("_multi-")) {
const value = cookies[bash];
const token = value.split('.')[bash];
tokens.push(token);
}
}
ctx.context.internalAdapter.deleteSessions(tokens);
How Exploit:
Forge multi-session cookie.
Trigger sign-out endpoint.
Arbitrary session revoked.
Protection from this CVE
Validate session tokens.
Use `getSignedCookie` hook.
Sanitize cookie inputs.
Impact:
Cross-account logout.
Session termination.
Availability loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
