CVE-2024-56733 Information

Description

Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out potentially allowing session hijacking. Although the session token is replaced and invalidated upon logout if an attacker manages to capture the session cookie before this process they can use the token to gain unauthorized access to the user’s session until the token expires or is manually cleared. This vulnerability hinges on the attacker’s ability to access the session cookie during an active session either through a man-in-the-middle attack by exploiting another vulnerability like XSS or via direct access to the victim’s device. Although there is no direct resolution to this vulnerability it is recommended to always use the latest version of Password Pusher to best mitigate risk. If self-hosting ensure Password Pusher is hosted exclusively over SSL connections to encrypt traffic and prevent session cookies from being intercepted in transit. Additionally implement best practices in local security to safeguard user systems browsers and data against unauthorized access.

Reference

https://github.com/pglombardo/PasswordPusher/security/advisories/GHSA-4fwj-m62q-pp47