User's session persist after permanently deleting his account in glpi-project/glpi

Valid

Reported on Sep 18th 2022

Description

If a user is logged in, and an admin decided to delete his account permanently, the user is still able to perform his normal actions until his session gets expired.

If a logged in user with admin role is deleted permanently, he's still able to delete other admins permanently, and if they are not logged in at that moment, they won't be able to access their account in the future.

Proof of Concept

  • Login as "admin" (Super-Admin)
  • Create a user ( tmp_admin ) with admin role
  • Login as "tmp_admin" in another browser
  • Using the "admin" account, delete "tmp_admin" account permanently
  • Go back the other browser where "tmp_admin" is logged in, and perform your normal actions, like creating a ticket, etc.
  • Log out from "admin" account
  • Using "tmp_admin" delete the "admin" account permanently
  • Now, you can't login as "admin"

Impact

  • A permanently deleted low privileged user can perform spamming since he's able to create tickets, also he can access the tickets that he's been assigned to and see the new answers.

  • A permanently deleted high privileged user can manage to permanently delete other admins and prevents them from accessing their accounts again, which may lead to total loss of all accounts.

CVE

CVE-2022-39234 published

Vulnerability Type

CWE-613: Insufficient Session Expiration

Severity

Medium (4.7)

Attack vector

Local

Attack complexity

High

Privileges required

High

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Open in visual CVSS calculator

Registry

Other

Affected Version

10.0.3

Visibility

Public

Status

Fixed

Found by

Seif-Allah Homrani @seifallahhomrani1
LIGHTWEIGHT