PT-2021-23937 · Zulip · Zulip

Alexmv · Published 2021-12-02 · Updated 2021-12-03 · CVE-2021-43791

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Zulip versions prior to 4.8

Description: Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions, expiration dates on the confirmation objects associated with email invitations were not enforced properly in the new account registration flow. A confirmation link takes a user to the check prereg key and redirect endpoint, before getting redirected to POST to /accounts/register/. The problem was that validation was happening in the check prereg key and redirect part and not in /accounts/register/ - meaning that one could submit an expired confirmation key and be able to register.

Recommendations: For versions prior to 4.8, upgrade to Zulip 4.8 as soon as possible, as there are no known workarounds for this issue.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2021-43791

GHSA-WJ76-PCQR-MF9F

Affected Products

Zulip

References · 7

• https://github.com/zulip/zulip/commit/a014ef75a3a0ed7f24ebb157632ba58751e732c6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-43791 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43791 · Vendor Advisory
• https://github.com/zulip/zulip/security/advisories/GHSA-wj76-pcqr-mf9f · Note
• https://t.me/cibsecurity/33245 · Telegram Post
• https://t.me/cvenotify/24074 · Telegram Post
• https://t.me/cvenotify/24197 · Telegram Post