The user, who was deleted from Github Organization, still can access all functions of federalist, in case he didn't do logout
Medium
G
GSA Bounty
Submitted None
Actions:
Reported by
sp1d3rs
Vulnerability Details
Technical details and impact analysis
##Description
Hi. I found a non-critical session management bug, which still can have serious impact in some scenarios.
When user perform login to the Federalist through Github, federalist checks his Organization ID (but only upon login).
When the user was deleted from organization for some reasons, but he was logged in the Federalist (or saved his session cookies), he can still do any action on behalf of organization (create sites, delete sites etc).
##Reproduction Steps & POC
1) Add a test user to your organization, which have access to the federalist.
2) Login to the Federalist.
3) Remove the user from organization, or leave organization
4) Try to create or delete the site. Federalist doesn't know that this user has no permissions, and will allow him to use functions.
##Suggested fix
You should implement Organization ID checking in the requests.
Upon login, the endpoint `/v0/me` is called (once). But it can be a good idea to call it in a random periods of time and check the organization ID, and in case it will return 403 - invalidate user session.
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Bounty
$300.00
Submitted
Weakness
Improper Authentication - Generic