0

There is a website with logout button, when I click on logout it just redirects me to login page. If I manually enter the dashboard URL in url bar im still logged in. Is this a security bug for that website and is there any CWE or CVE assigned to this kind of bug?

1
  • 1
    it's possible you are just viewing a local cached version of the page, but are not actually logged in. To test, try something that would require privileges... Commented May 18, 2020 at 21:35

2 Answers 2

1

Short answer: maybe.

Depending on the actual implementation, this is a small risk as @multithr3at3d mentioned. Believe it or not, this is common behavior. Many companies have internal battles over security vs. usability, and at a certain point, the company will make a decision to accept a certain level of risk.

Some things to consider

  1. Exactly how long is the cookie expiration set for?
  2. Does the session persist even after the user has closed their browser? (this is a bigger issue)
  3. What is the application actually doing? Banking apps require a higher level of security than cooking websites, clearly.

I am not advocating weak security practices. Rather, I'm just trying to illustrate how application owners may make decisions like this.

0

Yes, that does sound like improper session handling, or perhaps more serious authentication/authorization issues overall. You should probably do more investigation into how the application handles sessions and cookies.

I went to cwe.mitre.org and searched "logout"; there were a number of results that were applicable, such as CWE Category: Manage User Sessions. Within this group is CWE-613: Insufficient Session Expiration:

Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.

...

Insufficient Session Expiration could allow an attacker to use the browser's back button to access web pages previously accessed by the victim.

2
  • I think CWE-613 is more close. what is the risk level among low, medium, high and critical for this bug?
    – Rembo
    Commented Apr 17, 2020 at 15:13
  • @Rembo think about it... It's probably pretty low due to the situation required to abuse it. Commented Apr 18, 2020 at 16:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .