{"id":16705,"date":"2021-07-07T12:31:12","date_gmt":"2021-07-07T10:31:12","guid":{"rendered":"https:\/\/herolab-usd.formwandler.rocks\/security-advisories\/usd-2020-0053\/"},"modified":"2021-07-19T14:16:59","modified_gmt":"2021-07-19T12:16:59","slug":"usd-2020-0053","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2020-0053\/","title":{"rendered":"usd-2020-0053"},"content":{"rendered":"

[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\"]<\/p>\n

usd-2020-0053 | Gophish v0.10.1<\/h1>\n

<\/span>
Advisory ID<\/strong>: usd-2020-0053<\/span>
CVE Number<\/strong>: CVE-2020-24713<\/span>
Affected Product<\/strong>: Gophish<\/span>
Affected Version<\/strong>: v0.10.1<\/span>
Vulnerability Type<\/strong>: Insufficient Session Expiration<\/span>
Security Risk<\/strong>: High<\/span>
Vendor URL<\/strong>: https:\/\/getgophish.com\/<\/a><\/span>
Vendor Status<\/strong>: Fix scheduled<\/span><\/p>\n

<\/h3>\n

Description<\/h3>\n

The client\u2019s session cookie \u201cgophish\u201d doesn\u2019t get invalidated on the server side upon logout. A new cookie is sent to the client however the old session cookie can be used for browsing the settings page and to retrieve the API key.<\/span><\/p>\n

<\/span><\/p>\n

Proof of Concept (PoC)<\/h3>\n

A user\u2019s session is not invalidated on the server-side upon logout. Hence, it is possible to continue browsing pages using the old session and a web application proxy such as Burp. The following screenshot illustrates how an HTTP request containing a logged out session returns the same response as if the session\u2019s owner was still logged in.<\/p>\n

    \n
  1. Logout using \/logout<\/li>\n
  2. Replay previously captured request to \/settings<\/code> (including old cookie) \u2013 observe that the session was not invalidated server-side<\/li>\n<\/ol>\n

    [\/et_pb_text][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/usd20200053-1.png\" _builder_version=\"4.9.4\" _module_preset=\"default\" title_text=\"usd20200053-1\" hover_enabled=\"0\" sticky_enabled=\"0\"][\/et_pb_image][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/usd20200053-2.png\" _builder_version=\"4.9.4\" _module_preset=\"default\" title_text=\"usd20200053-2\" hover_enabled=\"0\" sticky_enabled=\"0\"][\/et_pb_image][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\"]<\/p>\n

    \n
    \n

    Fix<\/h3>\n

    Upon logout, user sessions should be terminated both client and server side.<\/p>\n

     <\/p>\n

    <\/h3>\n

    Timeline<\/h3>\n
      \n
    • 2020-06-18 First contact request via security@getgophish.com<\/li>\n
    • 2020-06-22 Vendor responds to initial contact<\/li>\n
    • 2020-08-20 Vendor accepts the risk of publication while waiting for the underlying authentication library to fix the issue<\/li>\n
    • 2020-09-29 Security advisory released<\/li>\n<\/ul>\n

      <\/h3>\n

      Credits<\/h3>\n

      This security vulnerability was found by Marcus Nilsson of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n

      [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"

      usd-2020-0053 | Gophish v0.10.1 Advisory ID: usd-2020-0053CVE Number: CVE-2020-24713Affected Product: GophishAffected Version: v0.10.1Vulnerability Type: Insufficient Session ExpirationSecurity Risk: HighVendor URL: https:\/\/getgophish.com\/Vendor Status: Fix scheduled Description The client\u2019s session cookie \u201cgophish\u201d doesn\u2019t get invalidated on the server side upon logout. A new cookie is sent to the client however the old session cookie can be used […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16705","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16705","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16705"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16705\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16705"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}