CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS
Percentile
23.9%
Use of Pow.Store.Backend.MnesiaCache
is susceptible to session hijacking as expired keys are not being invalidated correctly on startup. A cache key may become expired when all Pow.Store.Backend.MnesiaCache
instances have been shut down for a period that is longer than the keys’ remaining TTL and the expired key won’t be invalidated on startups.
The expired keys, including all expired sessions, can be manually invalidated by running:
:mnesia.sync_transaction(fn ->
Enum.each(:mnesia.dirty_select(Pow.Store.Backend.MnesiaCache, [{{Pow.Store.Backend.MnesiaCache, :_, :_}, [], [:"$_"]}]), fn {_, key, {_value, expire}} ->
ttl = expire - :os.system_time(:millisecond)
if ttl < 0, do: :mnesia.delete({Pow.Store.Backend.MnesiaCache, key})
end)
end)
https://github.com/pow-auth/pow/commit/15dc525be03c466daa5d2119ca7acdec7b24ed17
https://github.com/pow-auth/pow/issues/713
https://github.com/pow-auth/pow/pull/714