FreeBSD: VID-94B2D58A-C1E9-11EF-AA3F-DCFE074BD614 (CVE-2024-55603): kanboard -- Insufficient session invalidation

FreeBSD: VID-94B2D58A-C1E9-11EF-AA3F-DCFE074BD614 (CVE-2024-55603): kanboard -- Insufficient session invalidation

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

12/19/2024

Created

12/28/2024

Added

12/26/2024

Modified

12/26/2024

Description

Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler (`app/Core/Session/SessionHandler.php`), to store the session data in a database. Therefore, when a `session_id` is given, kanboard queries the data from the `sessions` sql table. At this point, it does not correctly verify, if a given `session_id` has already exceeded its lifetime (`expires_at`).

Thus, a session which's lifetime is already `> time()`, is still queried from the database and hence a valid login. The implemented **SessionHandlerInterface::gc** function, that does remove invalid sessions, is called only **with a certain probability** (_Cleans up expired sessions. Called by `session_start()`, based on `session.gc_divisor`, `session.gc_probability` and `session.gc_maxlifetime` settings_) accordingly to the php documentation. In the official Kanboard docker image these values default to: session.gc_probability=1, session.gc_divisor=1000. Thus, an expired session is only terminated with probability 1/1000. This issue has been addressed in release 1.2.43 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Solution(s)

• freebsd-upgrade-package-kanboard

References

• CVE-2024-55603