CVE-2022-35943

Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**. As a workaround: set `Config\Security::$csrfProtection` to `'session,'`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)

CVSS v3.0 8.8 HIGH

8.8^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite	Third Party Advisory
https://jub0bs.com/posts/2021-01-29-great-samesite-confusion	Third Party Advisory
https://codeigniter4.github.io/userguide/libraries/security.htm	Broken Link
https://github.com/codeigniter4/shield/security/advisories/GHSA-5hm8-vh6r-2cjq	Exploit Mitigation Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:codeigniter:codeigniter::::::::
	cpe:2.3:a:codeigniter:shield:1.0.0:beta::::::

Information

Published : 2022-08-12 14:15

Updated : 2022-08-16 09:06

NVD link : CVE-2022-35943

Mitre link : CVE-2022-35943

JSON object : View

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

Advertisement

Products Affected

codeigniter

shield
codeigniter

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", "name": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://jub0bs.com/posts/2021-01-29-great-samesite-confusion", "name": "https://jub0bs.com/posts/2021-01-29-great-samesite-confusion", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://codeigniter4.github.io/userguide/libraries/security.htm", "name": "https://codeigniter4.github.io/userguide/libraries/security.htm", "tags": ["Broken Link"], "refsource": "MISC"}, {"url": "https://github.com/codeigniter4/shield/security/advisories/GHSA-5hm8-vh6r-2cjq", "name": "https://github.com/codeigniter4/shield/security/advisories/GHSA-5hm8-vh6r-2cjq", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name/) to bypass the [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html) mechanism with CodeIgniter Shield. For this attack to succeed, the attacker must have direct (or indirect, e.g., XSS) control over a subdomain site (e.g., `https://a.example.com/`) of the target site (e.g., `http://example.com/`). Upgrade to **CodeIgniter v4.2.3 or later** and **Shield v1.0.0-beta.2 or later**. As a workaround: set `Config\\Security::$csrfProtection` to `'session,'`remove old session data right after login (immediately after ID and password match) and regenerate CSRF token right after login (immediately after ID and password match)"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-352"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-35943", "ASSIGNER": "security-advisories@github.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}}, "publishedDate": "2022-08-12T21:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:codeigniter:codeigniter:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "4.2.3"}, {"cpe23Uri": "cpe:2.3:a:codeigniter:shield:1.0.0:beta:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-08-16T16:06Z"}