Session Persistence in FOSSBilling After Account Suspension

Executive Summary

This vulnerability exists in FOSSBilling versions prior to 0.8.0. When a client or staff/admin account is suspended or marked inactive, the system does not invalidate existing authenticated sessions for that user. The session identity loaders only reject sessions if the account no longer exists in the database, but they do not check if the account is still active. As a result, suspended or deactivated users can continue to access the system with their existing sessions until those sessions expire naturally.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves suspended or inactive accounts retaining access through existing authenticated sessions because session identity loaders do not verify account status. Detection involves identifying active sessions belonging to suspended or inactive users.

A practical approach is to manually review and delete sessions associated with suspended or inactive accounts, as the vulnerability allows these sessions to remain valid until expiration.

Since the issue is related to session management in FOSSBilling, you can inspect session storage (e.g., database tables or session files) to find sessions linked to suspended accounts.

Suggested commands depend on your session storage method. For example, if sessions are stored in a database, you might run SQL queries to find active sessions for suspended users.

• Example SQL query to find sessions for suspended users (assuming sessions and user status are stored in the database):
• SELECT sessions.* FROM sessions JOIN users ON sessions.user_id = users.id WHERE users.status = 'suspended' AND sessions.is_active = 1;
• If sessions are stored as files, you can search session files for user IDs of suspended accounts using grep or similar tools.
• Example command to find session files containing suspended user IDs: grep -rl 'user_id=123' /path/to/session/files/

After detection, manually deleting these sessions will mitigate the risk until the system is upgraded to version 0.8.0 or later.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow suspended or deactivated users to retain full access to the system despite their account status change. This means unauthorized access can persist, potentially leading to unauthorized actions, data exposure, or misuse of system resources until the user's session expires.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows suspended or deactivated users to retain full access to the FOSSBilling system through existing authenticated sessions, API tokens, and password reset flows until those sessions expire or are manually deleted.

Such unauthorized continued access can lead to unauthorized data exposure or modification, which may violate data protection requirements under regulations like GDPR or HIPAA that mandate strict access controls and timely revocation of access for inactive or suspended accounts.

Therefore, until patched, this vulnerability could negatively impact compliance with these standards by failing to enforce proper session invalidation and account status verification.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade FOSSBilling to version 0.8.0 or later, where the issue has been fixed.

Until the upgrade is applied, consider manually invalidating existing sessions for suspended or deactivated users to prevent continued access.

Useful 0 Not Useful 0