Listen to this Post
This vulnerability stems from a flaw in the Single Log-Out (SLO) API implementation within Liferay Portal and DXP. The system fails to properly invalidate a user’s session on the server-side upon logout. Instead, it may only rely on client-side session destruction, such as clearing cookies. This allows an old session identifier, which should be expired, to remain valid on the application server. A remote, non-authenticated attacker who obtains a valid session ID (e.g., through packet sniffing or a man-in-the-middle attack) can reuse it to impersonate the user even after the user has logged out. The SLO API does not comprehensively propagate the session termination signal, leaving the session active and susceptible to hijacking, effectively bypassing the intended security measure of session expiration.
Platform: Liferay Portal/DXP
Version: 7.4.3.121-7.3.3.131
Vulnerability: Session Fixation
Severity: Moderate
date: 2024-09-24
Prediction: Patch expected 2024-10-08
What Undercode Say:
curl -s "http://target:8080/api/jsonws/invoke" --cookie "JSESSIONID=STOLEN_SESSION_ID"
// Check for active session
HttpSession session = request.getSession(false);
if (session != null) {
// Session still active post-logout
}
How Exploit:
An attacker captures a valid JSESSIONID. The victim logs out, but the server-side session remains active. The attacker reuses the captured JSESSIONID cookie to gain unauthorized access to the victim’s account without requiring credentials.
Protection from this CVE:
Apply vendor patch. Implement server-side session invalidation upon logout. Configure short session timeout values. Use secure cookies with HttpOnly and Secure flags.
Impact:
Session hijacking. Unauthorized access. Account takeover.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
