Description

CVE-2024-55603 is a vulnerability in Kanboard, a project management software that utilizes the Kanban methodology. The issue stems from the improper handling of session lifetimes. Kanboard fails to adequately check if a session's lifetime has expired, allowing sessions to persist even after their expiration date. This is further exacerbated by the fact that the session garbage collection function is only executed with a low probability (1/1000) in the official Docker image, potentially leaving expired sessions active for extended periods.

SVRS: 42

The SVRS score of 42 indicates that while this vulnerability is not considered critically urgent, it still presents a significant security risk. It requires attention and timely mitigation to prevent potential exploitation.

Key Insights

• Persistence of Expired Sessions: The vulnerability allows attackers to potentially hijack expired sessions, gaining access to sensitive data and functionality within the Kanboard application.
• Low Probability of Garbage Collection: The infrequent session garbage collection increases the window of opportunity for attackers to exploit the vulnerability, as expired sessions might remain active for extended periods.
• Potential for Privilege Escalation: An attacker could potentially escalate their privileges by gaining control of an expired session belonging to a user with higher permissions.
• No Known Workarounds: Currently, there are no known workarounds for this vulnerability. The only recommended solution is to upgrade to Kanboard version 1.2.43 or later.

Mitigation Strategies

• Immediate Upgrade: The most effective mitigation strategy is to immediately upgrade to Kanboard version 1.2.43 or later. This update addresses the vulnerability and ensures proper session lifetime management.
• Increase Session Garbage Collection Frequency: If upgrading is not immediately feasible, consider increasing the session garbage collection frequency by adjusting the session.gc_probability and session.gc_divisor settings in the PHP configuration. This will increase the likelihood of expired sessions being removed.
• Implement Strong Authentication Practices: Employ robust authentication mechanisms, such as two-factor authentication (2FA), to further protect against unauthorized access even if an expired session is compromised.
• Regular Security Audits: Conduct regular security audits to identify and address any potential vulnerabilities, including those related to session management.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.