Insufficient Session Expiration in cortezaproject/corteza-server

Valid

Reported on

Feb 3rd 2022


Description

During testing it was found that if a user revoke his all active session, then also user is able to make changes to his account.

Proof of Concept

  1. Log in to the application
  2. Go to profile>login sessions and revoke all sessions.
  3. You will see that all other sessions are still valid and the user is able to revoke other user sessions by going to Users>edit>revoke sessions.

Impact

If a victim account is hacked and he wants to revoke all his sessions, but since the configuration provided is not proper, he won't be able to revoke all active user sessions as attacker is still able to make changes to hacked account.

We are processing your report and will contact the cortezaproject/corteza-server team within 24 hours. 4 months ago
We have contacted a member of the cortezaproject/corteza-server team and are waiting to hear back 4 months ago
Tomaž Jerman
4 months ago

Maintainer


Thanks for reporting!

Tomaž Jerman validated this vulnerability 4 months ago
shubh123-tri has been awarded the disclosure bounty
The fix bounty is now up for grabs
We have sent a fix follow up to the cortezaproject/corteza-server team. We will try again in 7 days. 3 months ago
We have sent a second fix follow up to the cortezaproject/corteza-server team. We will try again in 10 days. 3 months ago
We have sent a third and final fix follow up to the cortezaproject/corteza-server team. This report is now considered stale. 3 months ago
Denis Arh confirmed that a fix has been merged on 5ccf28 3 months ago
The fix bounty has been dropped
to join this conversation