Passbolt Api Retrieval of HTTP-only cookies
Summary
GHSA-f5pp-pmq8-gp46: Passbolt Api Retrieval of HTTP-only cookies. Affects passbolt/passbolt_api versions < 2.7.0. Fixed in 2.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Passbolt is an open-source password manager that uses three cookies for session management and security. These cookies include a session cookie, a CSRF protection cookie, and a cookie for multi-factor authentication. The session cookie and the multi-factor authentication cookie are set as HTTP-only to prevent attackers from accessing their content through XSS attacks.
Vulnerability Detail
The vulnerability in Passbolt Api allows an attacker to retrieve the session cookies of a legitimate user by exploiting an XSS vulnerability. This would grant the attacker access to sensitive information such as encrypted password lists and group lists without requiring any user interaction. The vulnerability has a low impact, but it relies on the existence of an XSS vulnerability that has not been discovered yet.
How To Fix
Minimum fixed version
2.7.0
This is the first release that contains the fix.
composer require passbolt/passbolt_api:2.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is crucial to update to the fixed version as soon as possible.
Conclusion
Passbolt Api is vulnerable to the retrieval of HTTP-only cookies through an XSS vulnerability. It is important to update to version 2.7.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for passbolt/passbolt_api →
FAQ
Passbolt is an open-source password manager that allows users to store and manage their passwords securely.
Passbolt uses three cookies: a session cookie, a CSRF protection cookie, and a cookie for multi-factor authentication.
The vulnerability allows an attacker to retrieve session cookies, granting them access to sensitive information without user interaction.
Update Passbolt Api to version 2.7.0 or later to fix this vulnerability.
There is no specific workaround mentioned. Updating to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for passbolt/passbolt_api.
