Insufficient Session Expiration in cortezaproject/corteza-server
Valid
Reported on
Feb 3rd 2022
Description
During testing it was found that if a user revoke his all active session, then also user is able to make changes to his account.
Proof of Concept
- Log in to the application
- Go to profile>login sessions and revoke all sessions.
- You will see that all other sessions are still valid and the user is able to revoke other user sessions by going to Users>edit>revoke sessions.
Impact
If a victim account is hacked and he wants to revoke all his sessions, but since the configuration provided is not proper, he won't be able to revoke all active user sessions as attacker is still able to make changes to hacked account.
We are processing your report and will contact the
cortezaproject/corteza-server
team within 24 hours.
a year ago
We have contacted a member of the
cortezaproject/corteza-server
team and are waiting to hear back
a year ago
We have sent a
fix follow up to the
cortezaproject/corteza-server
team.
We will try again in 7 days.
a year ago
We have sent a
second
fix follow up to the
cortezaproject/corteza-server
team.
We will try again in 10 days.
a year ago
We have sent a
third and final
fix follow up to the
cortezaproject/corteza-server
team.
This report is now considered stale.
a year ago
to join this conversation