2. Mailing Lists
  3. in
  4. Vulnerability Report 02: Failure to invalidate session on Password Change

Archives

Vulnerability Report 01: Failure to invalidate session on Email Change

Vulnerability Report 03:No CSRF protection on login

Vulnerability Report 02: Failure to invalidate session on Password Change

Hi team,
 
I am a security researcher and this time I found this vulnerability
in your website. 
 
Vulnerability Report : Failure to invalidate session on Password Change 
 
Weakness: Insufficient Session Expiration
 
Description :  
 
I observe that when we change password from one browser in place of session
Expire from other browser its just update password from other browser and
the old session got updated without being logout
 
Steps to check Session Management issue On password change :
 
1- login From two browser at a time [ From Chrome browser and From Mozilla
Firefox ]
2- Change password in setting from chrome browser
3- Now Check Mozilla Firefox
4- Your Session Got Updated in place of expiration
 
Recommendations:
 
If Session is Updating From One Browser so Others Should Expire First to renew session after login.
 

Impact

If the attacker has a user password and logged in different places, As other sessions are not destroyed, the attacker will be still logged in your account even after changing password, cause his session is still active.. Malicious actor can completely access your account till that session expires! So, your account remains insecure even after the changing of password.

Please let me know if any more info is needed !  

Looking after your response.
 
Thanks & Regards,
Through Star jet Cyber,
Afshan
by "starjet cyber" <starjetcyber22@gmail.com> - 10:19 - 12 Aug 2024