by Kastro
Paper/Archive/CVE-2021-25985

CVE-2021-25985

FactorJS Factor — FactorJS - Insufficient Session Expiration Leads to a Local Account Takeover

EPSS 0.8%public exploitCVSS 9.8
critical.is priorityof 100
51
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.9.559 × 2011.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

In Factor (App Framework & Headless CMS) v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an attacker to steal and reuse the cookies using techniques such as XSS attacks, followed by a local account takeover.

Affected

ProductAffectedFixed inSource
Factor1.0.4 – < unspecifiedunspecifiedCNA
Factorunspecified – 1.8.30–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mend (CNA)7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/FactorJS/factor/blob/v1.8.30/%40factor/user/util.ts#L65refwhitesourcesoftware.com/vulnerability-database/CVE-2021-25985