Executive Summary

This vulnerability exists in CI4MS, a CodeIgniter 4-based CMS skeleton, where prior to version 0.31.0.0, the system fails to immediately revoke active user sessions when an account is deleted.

Due to a logic flaw, account state changes are only enforced during login, not for sessions that are already active. This means that if a user account is deleted, the user can still access the system indefinitely until they manually log out.

There is no session expiration or account expiration mechanism, so deleted accounts retain unauthorized access, breaking the intended access control policy.

This issue was fixed in version 0.31.0.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to persistent unauthorized access by users whose accounts have been deleted.

Since active sessions are not revoked immediately, deleted users can continue to access sensitive information or perform actions within the system until they log out manually.

This undermines the security and access control policies of the application, potentially exposing data or functionality to unauthorized individuals.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves persistent unauthorized access due to active user sessions not being revoked immediately after account deletion in CI4MS versions prior to 0.31.0.0. Detection involves identifying active sessions belonging to deleted accounts.

To detect this on your system, you can:

• Check the session store or database for active sessions linked to user accounts that no longer exist or have been deleted.
• Review backend logs or audit trails (if available) for user activity from accounts that should have been deleted.
• Use database queries to find sessions with user IDs that are missing from the users table.

Example commands (assuming a SQL-based session store and user table):

• SQL query to find sessions with deleted users: SELECT session_id, user_id FROM sessions WHERE user_id NOT IN (SELECT id FROM users);
• Check active sessions on the server (Linux example): ps aux | grep php or netstat -anp | grep LISTEN to identify active session processes or connections.
• Review application logs for suspicious or persistent activity from deleted accounts if audit logging is enabled.

Upgrading to version 0.31.0.0 or later is recommended as it includes fixes that properly invalidate sessions upon account deletion.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade the CI4MS application to version 0.31.0.0 or later, where the issue has been patched.

Until the upgrade is applied, consider manually terminating active user sessions when accounts are deleted to prevent persistent unauthorized access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows deleted user accounts to retain active sessions indefinitely, resulting in persistent unauthorized access. Such behavior breaks the intended access control policy.

Persistent unauthorized access due to failure to revoke sessions immediately upon account deletion can lead to non-compliance with common security requirements found in standards and regulations like GDPR and HIPAA, which mandate strict access control and timely revocation of user privileges.

Useful 0 Not Useful 0