CVE-2021-3311: Critical severity October CMS Debugbar vulnerability
Impact When logging out, the session ID was not invalidated. This is not a problem while the user is logged out, but as soon as the user logs back in the old session ID would be valid again; which means that anyone that gained access to the old session cookie would be able to act as the logged in user. This is not a major concern for the majority of cases, since it requires a malicious party gaining access to the session cookie in the first place, but nevertheless has been fixed.
Patches Issue has been patched in Build 472 (v1.0.472) and v1.1.2.
Workarounds Apply https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024 to your installation manually if unable to upgrade to Build 472 or v1.1.2.
References - Reported by Anisio (Brazilian Information Security Analyst) - http://cve.circl.lu/cve/CVE-2021-3311
For more information If you have any questions or comments about this advisory: Email us at hello@octobercms.com
Threat assessment: <img width="699" alt="Screen Shot 2021-02-07 at 11 50 35 PM" src="https://user-images.githubusercontent.com/7253840/107180881-51eaf000-699f-11eb-8828-333128faf2a6.png">
Other sources
An issue was discovered in October through build 471. It reactivates an old session ID (which had been invalid after a logout) once a new login occurs. NOTE: this violates the intended Auth/Manager.php authentication behavior but, admittedly, is only relevant if an old session ID is known to an attacker.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/october/rainto a version that resolves this vulnerability.Fixed in 1.1.2 - Upgrade
Upgrade
composer/october/rainto a version that resolves this vulnerability.Fixed in 1.0.472 - Upgrade
Upgrade
octobercmsto a version that resolves this vulnerability.Fixed in v1.0.472 - Upgrade
Upgrade
octobercmsto a version that resolves this vulnerability.Fixed in v1.1.2 - Upgrade
Upgrade
octobercms/libraryto a version that resolves this vulnerability.Patch 642f597489e6f644d4bd9a0c267e864cabead024 - Operational
After applying the fix, ensure any previously issued session cookies/session IDs are treated as invalid so that logged-out users’ old session IDs cannot be reactivated upon a new login.
Event History
Frequently Asked Questions
What is CVE-2021-3311?
CVE-2021-3311 is a vulnerability that allows the session ID to remain valid after logging out, potentially allowing unauthorized access.
How does CVE-2021-3311 impact users?
CVE-2021-3311 allows an attacker who gains access to the old session cookie to act as the logged-in user.
What is the severity of CVE-2021-3311?
CVE-2021-3311 has a severity rating of 9.8 out of 10, indicating it is critical.
Which software versions are affected by CVE-2021-3311?
CVE-2021-3311 affects versions up to 1.0.472 and between 1.1.0 and 1.1.2 of the October Rain package.
How can CVE-2021-3311 be fixed?
To fix CVE-2021-3311, users should update the October Rain package to version 1.1.2 or apply the specific fix provided by the package maintainers.