Express express-session Weak Secret Key Detected
Severity:
Medium
Summary
Invicti detected that a weak secret is used in Express sessions.
The Express web application uses the express-session middleware. The middleware stores a session id in a cookie and uses a secret key to sign it for protection against data tampering. The application is using a weak/known secret key and Invicti managed to guess this key.
Impact
An attacker can tamper the session id in the cookie.
Remediation
Required Skills for Successful Exploitation
Actions To Take
Change the value of the secret key to a long random string.
Classifications
Vulnerability Index
You can search and find all vulnerabilities
Select Category
Select Vulnerability
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
Build your resistance to threats. And save hundreds of hours each month.
