Executive brief
Apostrophe CMS is a Node.js-based content management system used to build and manage websites. A flaw in session management allows unauthenticated attackers to hijack the sessions of users who have recently logged in, potentially gaining unauthorized access to administrative functions and website content. This could allow an attacker to take control of the site or access sensitive data without needing valid credentials.
Technical details
Apostrophe CMS versions 2.63.0 through 3.3.1 fail to properly expire user sessions after logout or account inactivity, violating CWE-613 (Insufficient Session Expiration). The vulnerability allows unauthenticated remote attackers to reuse or hijack session tokens of recently logged-in users via network access. No authentication or user interaction is required to exploit this. An attacker can achieve full session takeover, accessing admin functionality with the privileges of the hijacked account. The issue was fixed in version 3.4.0; for older versions, archiving (3.x) or moving an account to trash (2.x) disables existing sessions as a workaround.
Affected products
- Apostrophe Apostrophe CMS 2.63.0 to 3.3.1
Timeline
- 2021-11-10: disclosed
- 2021-11-10: patched: Fixed in version 3.4.0