Authentication Token Exposure in BharatMLStack UI

Executive Summary

The vulnerability in BharatMLStack up to v1.3.0 involves Trufflebox UI storing sensitive data like JWT authentication tokens, full user objects, and session IDs in the browser's localStorage. This makes the data accessible to any JavaScript running on the page, increasing the risk of unauthorized access or theft.

Useful 0 Not Useful 0

Detection Guidance

Check browser localStorage for sensitive data like JWT tokens, user objects, or session IDs in Trufflebox UI. Use browser developer tools to inspect localStorage or run JavaScript console commands like localStorage.getItem('token') to retrieve stored values.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to steal authentication tokens, user session data, or other sensitive information if they can execute malicious JavaScript on the page. This may lead to unauthorized account access, data breaches, or further exploitation of the system.

Useful 0 Not Useful 0

Compliance Impact

Storing sensitive data like authentication tokens and user objects in localStorage may violate GDPR's data protection principles and HIPAA's security requirements for safeguarding protected health information. It increases the risk of unauthorized access, potentially leading to non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Disable localStorage for sensitive data storage in Trufflebox UI. Switch to secure alternatives like HTTP-only, secure cookies or sessionStorage with shorter expiration times. Review and update the application's authentication mechanism to avoid exposing tokens in client-side storage.

Useful 0 Not Useful 0