WatchGuard Dimension Session Token Exposure via Diagnostic Log

Executive Summary

This vulnerability involves WatchGuard Dimension software recording unredacted session identifiers for logged-in users in diagnostic logs. A low-privileged administrator can access these logs and extract a Super Administrator's session token while they are logged in, enabling account takeover.

Useful 0 Not Useful 0

Detection Guidance

Check WatchGuard Dimension diagnostic logs for unredacted session identifiers or tokens. Look for logs containing session IDs or CSRF tokens of Super Administrators while they are logged in. Verify if logs are accessible to low-privileged administrators.

Useful 0 Not Useful 0

Impact Analysis

An attacker could impersonate a Super Administrator, bypass access controls, modify system configurations, create or delete users, lock out legitimate administrators, and gain full administrative control over the Dimension appliance.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive administrative functions, potentially exposing personal data or protected health information. A low-privileged administrator could impersonate a Super Administrator, bypassing access controls and gaining full control over the system, which may violate GDPR's data protection requirements or HIPAA's access control mandates.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade WatchGuard Dimension to version 2.3.1 or later to address the vulnerability.
• Restrict access to diagnostic logs to only necessary administrators.
• Review logs for any unauthorized access or session token exposure.
• Rotate all Super Administrator session tokens and CSRF tokens if logs were accessed.

Useful 0 Not Useful 0