-
Type:
Bug
-
Status: Open
-
Priority:
Major
-
Resolution: Unresolved
-
Affects Version/s: None
-
Fix Version/s: None
-
Component/s: Security, Security / Rights
Authentication and Sessions > Failure to Invalidate Session > On Password Reset and/or Change
Proof of Concept
- Login into account on https://pentest.beta.nuxeocloud.com in two separate browsers
- From one browser, go to https://pentest.beta.nuxeocloud.com/nuxeo/ui/#!/profile and change password
- Now, check the old session tokens, they will be still active.
Suggested Fix
Properly invalidate all user sessions server-side when the user resets their password and at a minimum, invalidate all non-current user sessions sever-side when the user changes their password.
A secure session termination requires at least the following components:
- Availability of user interface controls that allow the user to manually log out.
- Session termination after a given amount of time without activity (session timeout).
- Proper invalidation of server-side session state.
The usage of a single sign-on (SSO) system instead of an application-specific authentication scheme often causes the coexistence of multiple sessions which have to be terminated separately