Couch-Auth Sensitive Data Exposure Vulnerability Allowing Session Hijacking

A vulnerability in Couch-Auth version 0.21.2 allows for sensitive data exposure, as session tokens and passwords are stored in JavaScript objects and remain in memory without explicit clearing. This issue creates a potential window for data extraction through memory dumps, debugging tools, or other memory access techniques, which could lead to session hijacking.

Impact

Exploitation of this vulnerability could result in unauthorized access to user accounts through session hijacking.

Reproduction

To reproduce this vulnerability, use Couch-Auth version 0.21.2 or earlier. After a user logs in, the session token and password are stored in memory. Without proper clearance, this sensitive information can be accessed through memory extraction techniques, such as debugging tools or memory dumps.

Remediation

Users can update to Couch-Auth version 0.25.0, which addresses this vulnerability by clearing session tokens and passwords from memory after use.