CVE-2022-35943: CodeIgniter - SameSite Attackers Bypass CSRF Protection
Summary
CVE-2022-35943: Shield is an authentication and authorization framework for CodeIgniter 4. Affects codeigniter versions < 4.2.3. Fixed in 4.2.3. How to fix ↓
Also tracked for
- codeigniter4/shield · Packagist
The same CVE-2022-35943 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CodeIgniter is a popular PHP framework used for developing web applications. It provides a range of features and libraries to simplify the development process. One of the key components of CodeIgniter is the Shield authentication and authorization framework, which helps secure user sessions and protect against cross-site request forgery (CSRF) attacks. However, a vulnerability has been discovered in CodeIgniter Shield that allows SameSite attackers to bypass the CSRF protection mechanism. This vulnerability can be exploited if the attacker has control over a subdomain site of the target site. Upgrading to CodeIgniter v4.2.3 or later and Shield v1.0.0-beta.2 or later is recommended to mitigate this issue.
Vulnerability Detail
The vulnerability in CodeIgniter Shield allows SameSite attackers to bypass the CSRF protection mechanism. To exploit this vulnerability, the attacker must have control over a subdomain site of the target site. By bypassing the CSRF protection, the attacker can perform unauthorized actions on behalf of the victim user, potentially leading to data breaches, account hijacking, or other malicious activities. The vulnerability has been assigned a CVSSv3 severity score of 9.8 (Critical).
How To Fix
Minimum fixed version
4.2.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set Config\Security::$csrfProtection to 'session,' in your CodeIgniter configuration file. Additionally, after successful login (immediately after ID and password match), remove old session data and regenerate the CSRF token. This will help mitigate the risk of SameSite attackers bypassing the CSRF protection mechanism.
Conclusion
The vulnerability in CodeIgniter Shield allows SameSite attackers to bypass the CSRF protection mechanism, potentially leading to unauthorized actions and other malicious activities. It is crucial to upgrade to the recommended versions and apply the provided workaround to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for codeigniter →
FAQ
CodeIgniter is a PHP framework used for developing web applications. It provides a range of features and libraries to simplify the development process.
CodeIgniter Shield is an authentication and authorization framework for CodeIgniter 4. It helps secure user sessions and protect against cross-site request forgery (CSRF) attacks.
A SameSite attacker is an attacker who has control over a subdomain site of the target site. They can exploit the vulnerability in CodeIgniter Shield to bypass the CSRF protection mechanism.
The potential consequences of this vulnerability include unauthorized actions performed on behalf of the victim user, data breaches, account hijacking, and other malicious activities.
You can mitigate this vulnerability by upgrading to CodeIgniter v4.2.3 or later and Shield v1.0.0-beta.2 or later. Additionally, you can apply the temporary workaround mentioned in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for codeigniter.
