"remember_user_token" is not getting revoked - Attacker able to takeover victim account
HackerOne report #896225 by vaib25vicky
on 2020-06-11, assigned to @ngeorge1:
Summary
Gitlab user have a option to revoke active session which deletes the user session and prevent attacker to access his account. BUT the remember_user_token
is not getting revoked and with the help of only this token one is able to login as well as able to create new _gitlab_session
token.
Steps to reproduce
(Step-by-step guide to reproduce the issue, including:)
- login as
testUser
and chooseremember me
option - copy
remember_user_token
and open new browser or incognito window - on new browser/incognito window login as
testUser
again - from original browser/window delete active session by going over settings
- refresh new browser/incognito window , you'll see your session has been revoked
- Now, paste the
remember_user_token
and its value and refresh - Voila, you are login as
testUser
again even when session get revoked. - Go to cookies and you'll see a new
_gitlab_session
token has also been created.
Impact
remember_user_token
is not getting revoked - Attacker able to takeover victim account
What is the current bug behavior?
remember_user_token
is not getting revoked along with session token
What is the expected correct behavior?
remember_user_token
should also get revoke along with session cookie beacuse then there is no point of revoking only session token. Attacker can again login to the victim account even when he has revoke the session and access his sensitive information or change his settings
Output of checks
This bug happens on GitLab.com
Please let me know if you need more info.
Cheers,
Vaibhav Singh
Impact
remember_user_token is not getting revoked even when user opt to revoke the session and allowing an attacker to access the vicitm account again using only remember_user_token