Description

The session store rotation logic creates backups using fs.promises.copyFile(storePath, backupPath) without validating that the source/destination paths are regular files and without protecting against symlink/hardlink races.

If an attacker can influence storePath or can write within the sessions directory (e.g., via a misconfigured writable state dir, shared host, or compromised local account), they may be able to:

• Read unintended files: if storePath is (or is replaced with) a symlink to another file, copyFile() will copy the symlink target into a backup.
• Overwrite unintended files: if an attacker can pre-create or race-create backupPath (predictable Date.now()-based name) as a symlink/hardlink, copyFile() may overwrite the link target.
• Exploit TOCTOU: the code checks size with stat() and then performs the copy later; the file could be swapped between these operations.

Vulnerable code:

const backupPath = `${storePath}.bak.${Date.now()}`;
await fs.promises.copyFile(storePath, backupPath);

Recommendation

Harden backup creation against symlink/hardlink attacks and TOCTOU:

• Ensure the source is a regular file (use lstat() and reject symlinks), and consider opening it once and copying from the file descriptor.
• Create the destination atomically and exclusively, and avoid following symlinks.
• Optionally, enforce that storePath resides within an expected trusted directory.

Example approach (POSIX-oriented):

import fs from "node:fs";
import path from "node:path";

const srcStat = await fs.promises.lstat(storePath);
if (!srcStat.isFile()) throw new Error("session store is not a regular file");

const backupPath = `${storePath}.bak.${Date.now()}`;

​// Open destination with O_EXCL so an attacker cannot precreate a symlink/hardlink.
const dstFd = await fs.promises.open(backupPath, fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_WRONLY, 0o600);
try {
  ​// Copy from an already-opened source fd to avoid TOCTOU swaps.
  const srcFd = await fs.promises.open(storePath, fs.constants.O_RDONLY);
  try {
    await fs.promises.copyFile(srcFd.fd, dstFd.fd);
  } finally {
    await srcFd.close();
  }
} finally {
  await dstFd.close();
}

Also consider best-effort cleanup using unlink() only after verifying the target is within the expected directory and (if possible) is a regular file.

Description

rotateSessionFile() logs the raw err object when backup creation fails.

• Input: err comes from fs.promises.copyFile(storePath, backupPath) failures.
• Many Node.js filesystem errors (NodeJS.ErrnoException) include enumerable fields such as path, dest, syscall, errno, and code.
• The logging subsystem’s JSON console mode and file logger both serialize metadata objects (see formatConsoleLine() spreading ...opts.meta and file transport JSON.stringify({ ...logObj, time })).
• As a result, logs can contain full filesystem paths and other operational details that may be sensitive in shared log environments.

Vulnerable code:

} catch (err) {
  log.warn("session store rotation backup failed", { err });
  return false;
}

Recommendation

Avoid logging the raw error object. Log a minimized/sanitized subset (e.g., code and a redacted message), and avoid including full paths.

Example fix:

} catch (err) {
  const e = err as NodeJS.ErrnoException;
  log.warn("session store rotation backup failed", {
    code: e.code,
    syscall: e.syscall,
    message: e.message, // consider redacting/normalizing if it may contain paths
    path: e.path ? path.basename(String(e.path)) : undefined,
  });
  return false;
}

If you need stack traces, gate them behind an explicit debug/verbose flag and ensure log redaction is applied before serialization.