CVE-2024-55603

{"id": "CVE-2024-55603", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2024-12-19T00:15:06.713", "references": [{"url": "https://github.com/kanboard/kanboard/blob/main/app/Core/Session/SessionHandler.php#L40", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://github.com/kanboard/kanboard/commit/7ce61c34d962ca8b5dce776289ddf4b207be6e78", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/kanboard/kanboard/security/advisories/GHSA-gv5c-8pxr-p484", "tags": ["Exploit", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://www.php.net/manual/en/function.session-start.php", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://www.php.net/manual/en/session.configuration.php#ini.session.gc-divisor", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://www.php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://www.php.net/manual/en/session.configuration.php#ini.session.gc-probability", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://www.php.net/manual/en/sessionhandlerinterface.gc.php", "tags": ["Product"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "Kanboard is project management software that focuses on the Kanban methodology. In affected versions sessions are still usable even though their lifetime has exceeded. Kanboard implements a cutom session handler (`app/Core/Session/SessionHandler.php`), to store the session data in a database. Therefore, when a `session_id` is given, kanboard queries the data from the `sessions` sql table. At this point, it does not correctly verify, if a given `session_id` has already exceeded its lifetime (`expires_at`).\nThus, a session which's lifetime is already `> time()`, is still queried from the database and hence a valid login. The implemented **SessionHandlerInterface::gc** function, that does remove invalid sessions, is called only **with a certain probability** (_Cleans up expired sessions. Called by `session_start()`, based on `session.gc_divisor`, `session.gc_probability` and `session.gc_maxlifetime` settings_) accordingly to the php documentation. In the official Kanboard docker image these values default to: session.gc_probability=1, session.gc_divisor=1000. Thus, an expired session is only terminated with probability 1/1000. This issue has been addressed in release 1.2.43 and all users are advised to upgrade. There are no known workarounds for this vulnerability."}, {"lang": "es", "value": "Kanboard es un software de gesti\u00f3n de proyectos que se centra en la metodolog\u00eda Kanban. En las versiones afectadas, las sesiones a\u00fan se pueden utilizar aunque su vida \u00fatil haya excedido. Kanboard implementa un gestionador de sesi\u00f3n personalizado (`app/Core/Session/SessionHandler.php`), para almacenar los datos de la sesi\u00f3n en una base de datos. Por lo tanto, cuando se proporciona un `session_id`, Kanboard consulta los datos de la tabla SQL `sessions`. En este punto, no verifica correctamente si un `session_id` dado ya ha excedido su vida \u00fatil (`expires_at`). Por lo tanto, una sesi\u00f3n cuya vida \u00fatil ya es `> time()`, a\u00fan se consulta desde la base de datos y, por lo tanto, es un inicio de sesi\u00f3n v\u00e1lido. La funci\u00f3n **SessionHandlerInterface::gc** implementada, que elimina sesiones no v\u00e1lidas, se llama solo **con cierta probabilidad** (_Limpia sesiones caducadas. Llamada por `session_start()`, basada en las configuraciones `session.gc_divisor`, `session.gc_probability` y `session.gc_maxlifetime`_) de acuerdo con la documentaci\u00f3n de php. En la imagen oficial de Docker de Kanboard, estos valores predeterminados son: session.gc_probability=1, session.gc_divisor=1000. Por lo tanto, una sesi\u00f3n caducada solo se termina con una probabilidad de 1/1000. Este problema se ha solucionado en la versi\u00f3n 1.2.43 y se recomienda a todos los usuarios que actualicen. No existen workarounds conocidos para esta vulnerabilidad."}], "lastModified": "2025-03-12T17:42:31.367", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kanboard:kanboard:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79E29EC0-1572-49D5-8077-7803D7AD75C3", "versionEndExcluding": "1.2.43"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}