Peppermint Authorization Bypass via Arbitrary User Logout

Executive Summary

Peppermint through version 0.5.5 has an authorization bypass flaw in the logout endpoint. Authenticated attackers can delete sessions for any user by providing arbitrary user IDs. The endpoint fails to verify if the caller owns the target account, allowing forced logouts of any user including administrators.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unauthorized logout requests targeting arbitrary user IDs. Check server logs for repeated calls to the /api/v1/auth/user/:id/logout endpoint with varying IDs. Look for failed authentication attempts following such requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to forcibly log out users, disrupting access to the system. Administrators could be logged out, causing service disruptions. Users may lose access to their sessions without warning, leading to potential data loss or service unavailability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by enabling unauthorized session termination, potentially disrupting user access to sensitive data. For GDPR, it may compromise data availability and integrity, while for HIPAA, it could disrupt healthcare service access. The lack of proper authorization checks in session management increases risks of unauthorized access or service disruption.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Peppermint to the latest version beyond 0.5.5. Implement strict authorization checks on the logout endpoint to ensure only the logged-in user can log out. Review server logs for signs of exploitation and revoke any suspicious sessions.

Useful 0 Not Useful 0