PT-2021-16908 · Factor · Factor

Published 2021-11-16 · Updated 2021-11-19 · CVE-2021-25985

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Factor (App Framework & Headless CMS) versions 1.0.4 through 1.8.30

Description The issue arises from improper session invalidation after a user logs out, combined with the storage of user sessions in the browser's local storage, which lacks an expiration time by default. This allows an attacker to potentially steal and reuse cookies through techniques like XSS attacks, leading to local account takeover.

Recommendations For versions 1.0.4 through 1.8.30, consider implementing proper session invalidation upon user logout and setting an expiration time for sessions stored in local storage to mitigate the risk of session reuse. As a temporary workaround, restrict access to sensitive areas of the application that rely on session-based authentication until a more permanent fix can be applied.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2021-25985

Affected Products

Factor

References · 6

• https://osv.dev/vulnerability/CVE-2021-25985 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-25985 · Security Note
• https://github.com/FactorJS/factor/blob/v1.8.30/%40factor/user/util.ts#L65 · Note
• https://t.me/cibsecurity/32507 · Telegram Post
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25985 · Note
• https://t.me/cvenotify/23436 · Telegram Post