CVE-2023-31999: CSRF
All versions of @fastify/oauth2 used a statically generated state parameter at startup time and were used across all requests for all users. The purpose of the Oauth2 state parameter is to prevent Cross-Site-Request-Forgery attacks. As such, it should be unique per user and should be connected to the user's session in some way that will allow the server to validate it. v7.2.0 changes the default behavior to store the state in a cookie with the http-only and same-site=lax attributes set. The state is now by default generated for every user. Note that this contains a breaking change in the checkStateFunction function, which now accepts the full Request object.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-31999?
CVE-2023-31999 has a medium severity rating due to its potential to expose users to Cross-Site-Request-Forgery attacks.
How do I fix CVE-2023-31999?
You can fix CVE-2023-31999 by upgrading to version 7.2.0 or later of the @fastify/oauth2 package.
What impact does CVE-2023-31999 have on user security?
CVE-2023-31999 can compromise user sessions by allowing the state parameter to be reused across requests, leading to CSRF vulnerabilities.
Which versions of @fastify/oauth2 are affected by CVE-2023-31999?
All versions of @fastify/oauth2 prior to 7.2.0 are affected by CVE-2023-31999.
Is CVE-2023-31999 actively being exploited?
As of now, there is no public indication that CVE-2023-31999 is being actively exploited in the wild.