FirstBlood-#757 — [COLLAB ] Session Invalidation at Vaccine Management Portal
This issue was discovered on FirstBlood v2
On 2021-10-28, mrrootsec Level 2 reported:
Hello Zseano, Hope you are doing well.. While analyzing the session based bugs I and Kinako observed this session invalidation behavior at vaccine-manager portal.
At /vaccination-manager/portal.php, the Firstblood V2 application is not successfully validating the session. Even after securely logging out, when we visit vaccination-manager/portal.php, it does not redirect to the login page, while the /drpanel portal validates it.
Steps to reproduce the issue :
Login with the valid credentials and Click on Logout
Close the Current Tab and Open a new Tab and paste the Below URL
Even after logging out from the vaccine portal,we still see the all details as logged in.
- If attacker have user password and logged in different places, As the sessions is not destroyed, attacker will be still logged in your account even after logging out from the application, cause the session is still active.. Malicious actor can complete access to the account till that session expires!
Remediation / Fix :
- Destroy the session after logging out from the application
- it is mandatory to set expiration timeouts for every session, establishing the amount of time a session will remain active.
Thanks and Regards
Mrroot & Kinako
FirstBlood ID: 43
Vulnerability Type: Application/Business Logic
The session cookie is not invalidated in the database and thus old session tokens are still valid until a new login is made and a new session token is set.