Session Expiration in MacroZheng Mall via Token Manipulation

Executive Summary

This vulnerability affects macrozheng mall up to version 1.0.3. It involves a flaw in the JWT token handling where disabled user accounts can still use previously issued tokens for authentication. The issue occurs because the system only checks account status during login but fails to validate it during token validation or request processing. This allows banned accounts to bypass restrictions using existing tokens until they expire after seven days.

Useful 0 Not Useful 0

Detection Guidance

Check for active sessions from disabled accounts by monitoring token usage in logs. Inspect the JwtAuthenticationTokenFilter and UmsAdminServiceImpl for missing account status validation during token processing. Look for repeated token refreshes via the /admin/refreshToken endpoint without account revalidation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to maintain unauthorized access to sensitive system areas even after their accounts are disabled. Attackers can perform sensitive operations using valid tokens, and the refreshToken interface can be exploited to indefinitely extend token validity. This undermines the account ban mechanism completely.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data by banned accounts, potentially violating GDPR's data protection principles and HIPAA's access controls. The flaw allows disabled accounts to retain token-based access, risking unauthorized data exposure or modification.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the patch 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a to update token validation logic. Ensure the validateToken method checks userDetails.isEnabled() before processing tokens. Review and update UmsMemberServiceImpl for proper account status checks during token generation and refresh.

Useful 0 Not Useful 0