Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend Vulnerability Database
We found results for “”
CVE-2021-25985
Date: November 16, 2021
Overview
In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by an account takeover.Details
Factor does not properly invalidate a user’s session even after the user initiates logout. User sessions are stored in “Localstorage”, which by default does have an expiration time, which makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks.Impact: An attacker can use previously used or available session token to takeover and login as a user in application.
PoC Details
Login to the application by going to http://localhost:3000. Go to Inspect > storage > Localstorage, copy the token and save it somewhere. Logout from the application.Now, again go to Inspect > Storage > Localstorage, and paste the token saved before. Refresh the page. We find that we are logged in to the application.
An attacker may also steal the session stored in localstorage using an XSS vulnerability. The url found in the "POC Code" section logs the token in the browser console.
PoC Code
http://localhost:3000/?category=%3Cscript%3Evar%20retrievedObject%20%3D%20localStorage.getItem%28%27token%27%29%3Bconsole.log%28%27retrievedObject%3A%20%27%2C%20JSON.parse%28retrievedObject%29%29%3B%3C%2Fscript%3EAffected Environments
1.0.4 to 1.8.30Prevention
No fixLanguage: VUE
Good to know:
| Base Score: |
|
|---|---|
| Attack Vector (AV): | Network |
| Attack Complexity (AC): | Low |
| Privileges Required (PR): | None |
| User Interaction (UI): | None |
| Scope (S): | Unchanged |
| Confidentiality (C): | High |
| Integrity (I): | High |
| Availability (A): | High |
| Base Score: |
|
|---|---|
| Access Vector (AV): | Network |
| Access Complexity (AC): | Low |
| Authentication (AU): | None |
| Confidentiality (C): | Partial |
| Integrity (I): | Partial |
| Availability (A): | Partial |
| Additional information: |