Authentication Bypass in Shiori via Unrevoked JWT Tokens

Executive Summary

This vulnerability involves improper handling of JWT tokens in Shiori's CheckToken function. The function only validates the HMAC signature of the token and returns embedded account claims without checking the current database state. This means account changes like deletion or role demotion do not invalidate existing tokens, allowing continued access with elevated privileges until the token naturally expires, which can be up to 30 days.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability cannot be directly detected through network or system commands as it is a logic flaw in the application code. The issue involves improper handling of JWT tokens after account changes. Monitor for unauthorized access attempts or privilege escalation events, particularly after account modifications like demotions or deletions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with a valid token could retain elevated privileges even after their account is deleted or downgraded. This allows unauthorized access to sensitive data or actions for up to 30 days. Users relying on token revocation for security would be unaware their access remains valid.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR's data protection principles by allowing unauthorized access to personal data even after account deletion. For HIPAA, it risks exposing protected health information to unauthorized users. Both standards require mechanisms to revoke access promptly, which this flaw fails to provide.

Useful 0 Not Useful 0

Mitigation Strategies

Implement a session store or token-revocation mechanism to invalidate tokens when account roles change or accounts are deleted. Shorten token expiry times and disable 'remember me' functionality to reduce exposure window.

Useful 0 Not Useful 0