Session Token Not Revoked After User Logout in Single Sign-On

Executive Summary

This vulnerability involves session-bound tokens not being revoked when a user session ends. It occurs when token binding validation is enabled and the 'Revoke token upon user logout' option is inactive. Attackers with valid tokens can maintain unauthorized access even after the user session is terminated, potentially exposing sensitive data.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if session-bound tokens are not being revoked upon user logout in WSO2 products. Review configuration files for token binding validation settings and verify if the 'Revoke token upon user logout' option is enabled. Inspect logs for active session-bound tokens after user logout events.

Useful 0 Not Useful 0

Impact Analysis

Unauthorized access to applications and resources may persist after a user logs out. Sensitive user data could be exposed if an attacker exploits the lingering session tokens. This may lead to data breaches or unauthorized actions performed under the victim's identity.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data even after session termination, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy). Unauthorized access risks exposing personal or protected health information, potentially resulting in non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Enable the 'Revoke token upon user logout' option in your WSO2 product configuration. Apply patches provided by WSO2 for affected versions. If using session-bound token feature with token binding validation, disable it unless absolutely necessary.

Useful 0 Not Useful 0