3

On one of the recent engagements, I bumped into something I have not seen before: after successful authentication attempt the user still can access the login web page and login as another user.

It did not seem to be a security flaw in a sense, as once you login as someone else your session ID is rewritten.

What do you think, is it more of a logical flaw or is there any way to exploit it that I have not thought of?

  • Do you mean that a login action (while being logged in) acts like an automated logout, followed by login as another user? – Jacco Mar 20 '16 at 20:15
  • Yes, indeed. The way it happens is: Login as User1 (new cookie value) -> Navigate to Login page, login as User2 (original cookie value gets rewritten). – Alex S. Mar 20 '16 at 20:40
1

This may be the case that the original user's session continues to live in the server and the original session key continues to be acceptable (even if it is not readily available in a cookie). Some minor security risks involving leaving the server-side of sessions hanging around include increasing the time window where a session hijacking is possible and not releasing unused server-side resources. As I said, these are pretty minor and are dealt with every time a user wanders away from the site without first logging out.

Note that the site may actually be logging out the first session on the server side before executing the second authentication. To determine what is actually happening, you would need to have access to server-side code or run a test where you capture the session ID before reauthentication, reauthenticate, and then try to reconnect with the initial session ID.

1

This doesn't seem to be a vulnerability. Even if you would allow a user to log in multiple times on the same page, this doesn't imply any security flaws because the session and user management could still be secure. However, being logged in as multiple users is a design flaw. If you can login again as a logged in user, the panel should be redesigned to display your profile etc including a logout button instead of the login form.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.