CVE-2021-25985 FactorJS - Insufficient Session Expiration Leads to a Local Account Takeover
Attackers can hijack user accounts by reusing stolen session tokens from local storage due to insufficient session expiration in FactorJS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-25985?
CVE-2021-25985 is a high-severity authentication bypass vulnerability in FactorJS Factor, published on 16 Nov 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover.
Weakness: CWE-613
Which versions are affected by CVE-2021-25985?
It affects 1 product.
Products include Darwin Factor.
How do I fix CVE-2021-25985?
No fix has been published for CVE-2021-25985 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-25985 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-25985 exists.
Other vulnerabilities in FactorJS Factor
Sources
Also known as GHSA-j232-863r-9977.