Description

The node session check can be bypassed if the ID is set to a key that exists natively in JavaScript objects, such as __proto__ or toString.

This issue occurs in tls-receipt-verifier/node/src/sessions/assert-session.ts:

export function getSession(id: string) { // id is user's input
	return storage[id]
}

export function assertSession(id: string) { // id is user's input
	const session = getSession(id)
	if(!session) {
		throw new ServerError(Status.NOT_FOUND, `session "${id}" not found`)
	}

	return session
}

Impact

If features like session ID--based login sessions are later implemented, they may be able to be bypassed.

Recommendations

The session ID's format should be validated in getSession and assertSession. Alternatively, the value may be checked using hasOwnProperty().

Remediation

CreatorOS Inc provided the following response:

The session is an opaque string right now, and will continue to be. So, even if it's overridden -- it doesn't compromise anything.