CVE-2023-45659 (published 2023-10-17T00:15Z)

Engelsystem is a shift planning system for chaos events.  If a users' password is compromised and an attacker gained access to a users' account, i.e., logged in and obtained a session, an attackers' session is not terminated if the users' account password is reset. This vulnerability has been fixed in the commit `dbb089315ff3d`. Users are advised to update their installations. There are no known workarounds for this vulnerability.

CVSS v3 base score: 2.8, LOW (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-613
cwe_name: Insufficient Session Expiration
description: According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
extended_description: 
            
            
            
         
         

Fix information:
repo_url: https://github.com/engelsystem/engelsystem
commit_details: repo_url: https://github.com/engelsystem/engelsystem
author: Igor Scheller
author_date: 2023-09-17 20:25:48+02:00
msg: Delete all sessions on password reset
repository: repo_url: https://github.com/engelsystem/engelsystem
repo_name: engelsystem/engelsystem
description: Shift planning system for chaos events.
repo_language: PHP
owner: engelsystem
file_changes: filename: PasswordResetController.php
change_type: ModificationType.MODIFY
diff: @@ -96,6 +96,8 @@ class PasswordResetController extends BaseController
         auth()->setPassword($reset->user, $data['password']);
         $reset->delete();
 
+        $reset->user->sessions()->getQuery()->delete();
+
         return $this->showView('pages/password/reset-success', ['type' => 'reset']);
     }
 

programming_language: PHP
filename: PasswordResetControllerTest.php
change_type: ModificationType.MODIFY
diff: @@ -15,6 +15,7 @@ use Engelsystem\Http\Request;
 use Engelsystem\Http\Response;
 use Engelsystem\Http\Validation\Validator;
 use Engelsystem\Mail\EngelsystemMailer;
+use Engelsystem\Models\Session as SessionModel;
 use Engelsystem\Models\User\PasswordReset;
 use Engelsystem\Models\User\User;
 use Engelsystem\Renderer\Renderer;
@@ -147,6 +148,8 @@ class PasswordResetControllerTest extends ControllerTest
             ['password' => $password, 'password_confirmation' => $password],
             ['token' => $token->token]
         );
+        SessionModel::factory()->create(); // Some other session
+        SessionModel::factory(3)->create(['user_id' => $user->id]);
 
         $controller = $this->getController(
             'pages/password/reset-success',
@@ -162,6 +165,12 @@ class PasswordResetControllerTest extends ControllerTest
         $this->assertEmpty((new PasswordReset())->find($user->id));
         $this->assertNotNull(auth()->authenticate($user->name, $password));
         $this->assertHasNoNotifications();
+
+        $this->assertEmpty(
+            SessionModel::whereUserId($user->id)->get(),
+            'All user sessions should be deleted after successful password reset'
+        );
+        $this->assertCount(1, SessionModel::all()); // Another session should be still there
     }
 
     /**

programming_language: PHP