Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-35943

CVE-2022-35943: CodeIgniter Shield Vulnerable to SameSite Attackers Bypassing the CSRF Protection

5.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-35943
GHSA ID
GHSA-5hm8-vh6r-2cjq
EPSS Score
0.02964%
CWE
CWE-352
Published
8/18/2022
Updated
1/30/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L
Package NameEcosystemVulnerable VersionsFirst Patched Version
codeigniter4/shieldcomposer= 1.0.0-beta1.0.0-beta.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key issues: 1) The Session authenticator's constructor lacked a check to enforce 'session' mode for CSRF protection. This allowed 'cookie' mode, which is susceptible to subdomain attacks due to cookie inheritance. 2) The login process did not forcibly regenerate CSRF tokens when configuration disallowed regeneration, leaving stale tokens active. The patch introduced a security check in the constructor and added token regeneration in startLogin(), directly addressing these flaws. Both functions were critical points where insecure configurations and token management enabled the bypass.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T*is vuln*r**ility m*y *llow [S*m*Sit* *tt**k*rs](*ttps://**nit*k*yoursu**om*in.n*m*/) to *yp*ss t** [*o**I*nit*r* *SR* prot**tion](*ttps://*o**i*nit*r*.*it*u*.io/us*r*ui**/li*r*ri*s/s**urity.*tml) m****nism wit* *o**I*nit*r S*i*l*. *or t

Reasoning

T** vuln*r**ility st*ms *rom two k*y issu*s: *) T** S*ssion *ut**nti**tor's *onstru*tor l**k** * ****k to *n*or** 's*ssion' mo** *or *SR* prot**tion. T*is *llow** '*ooki*' mo**, w*i** is sus**pti*l* to su**om*in *tt**ks *u* to *ooki* in**rit*n**. *)