Prototype pollution can weaken Express session cookies, researcher shows
Researcher varanda demonstrated that prototype pollution in Express applications can make the express-session library create session cookies with weakened security attributes, such as httpOnly: false and sameSite: none. The cause is a for...in loop that copies settings and also reads properties inherited through the prototype chain. No fix was cited; set cookie security attributes explicitly and address prototype pollution in the application.
What happened
A researcher demonstrated that a prototype pollution flaw in Express applications can make the express-session library issue session cookies with reduced protections, such as httpOnly disabled and sameSite none. This paves the way for CSRF and XSS attacks.
Why it matters
User sessions can be exposed to cookie theft and unauthorized actions on the user's behalf. The issue affects companies whose applications use Express with express-session and that also have a prototype pollution flaw.
What to do
Check that all Express applications explicitly set httpOnly, sameSite, secure and domain on session cookies. Fix prototype pollution sources in the application.
For the technical team
- Affected
- express-session (biblioteca de sessões para Node.js) · Express applications using the express-session library that are vulnerable to prototype pollution. The source cites no versions.
- Exploitation
- No exploitation reported. Research published by researcher varanda on dbugs.
- Fix
- Not cited in the source. Stated mitigation: explicitly set cookie security attributes (httpOnly, sameSite, secure, domain) in the session configuration.
- Vector
- The express-session library sets secure default values, such as httpOnly: true, then copies application settings into a new object using a for...in loop. That loop also iterates properties inherited through the prototype chain. If the application is vulnerable to prototype pollution, an attacker modifies Object.prototype and new cookies may pick up httpOnly: false and sameSite: none when the developer has not explicitly set those attributes.
- More details
- Cited consequences: httpOnly false makes session cookies accessible to JavaScript injection, increasing XSS risk; sameSite none allows the browser to send cookies in cross-site requests when Secure requirements are met, creating conditions for CSRF; changing Domain and Secure can expand the cookie's scope or weaken transmission protection. Cited example payload: {"__proto__": {"httpOnly": false, "sameSite": "none"}}.
Timeline
Research by varanda, published on dbugs, detailed the weakness in the library's cookie creation.
Sources 1 source
- @ptdbugs @ptdbugs
