Session Hijacking in wger Workout Manager

Executive Summary

The vulnerability in wger versions prior to 2.6 allows a gym trainer to escalate their session privileges to any higher-privileged account, such as gym manager or general manager. This is achieved by chaining two calls to the trainer-login endpoint. Once a trainer switches to a low-privileged user, the session flag trainer.identity is set, which bypasses permission checks on subsequent calls. This grants full gym administration capabilities, including access to member data and configuration settings.

Useful 0 Not Useful 0

Detection Guidance

Check if your wger instance is running a version prior to 2.6 by inspecting the version file or running the command: wger --version. Look for unauthorized privilege escalation attempts in logs, particularly repeated trainer-login calls with session flag trainer.identity set.

Useful 0 Not Useful 0

Impact Analysis

If you are a gym trainer or user of wger prior to version 2.6, an attacker could exploit this flaw to gain unauthorized access to higher-privileged accounts. This could lead to exposure of sensitive data, unauthorized modifications to gym settings, or misuse of member information. Users should update to version 2.6 or later to mitigate this risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade wger to version 2.6 or later immediately. If upgrading is not possible, restrict access to the trainer-login endpoint and monitor for suspicious session flag changes. Review user permissions and audit logs for any unauthorized privilege escalations.

Useful 0 Not Useful 0