[CKAN-Security] Auth_tkt Cookie Spoofing

[Adrià Mercader]

Thanks for the report Shubham,
The tech team will assess this and come back to you as soon as possible.

Best Regards,

Adrià


On Tue, 19 Feb 2019 at 14:15, Shubham Mahajan <mr.shubhammahajan at gmail.com>
wrote:

> Hi Team,
>
> I was going through my project and found out security issue in the CKAN
> core.
>
> ### CKAN Version if known (or site URL)
> ckan - 2.7.2 and https://demo.ckan.org/
>
> ### Please describe the expected behaviour
> The cookie should be invalidated if it is copied from other location or
> other device or when the user logged out from the device.
>
> ### Please describe the actual behaviour
> Once you logged into the CKAN, the cookie auth_tkt is generated. If I copy
> this cookie or the attacker got the cookie and open a fresh ckan portal and
> embedded the same cookie, its allowing to login to ckan portal.
> Even if you logout and use the old cookie, it will allow you to login.
> Tested in demo.ckan.org also.
>
> ### What steps can be taken to reproduce the issue?
> 1. Login to demo.ckan.org
> 2. Copy auth_tkt cookie.
> 3. Paste that cookie in any other machine or browser or private mode.
>
> It will log you in.
>
> *Even if you logout and login again and logout and use the old cookie, its
> still working.
>
> --
> Regards,
>
> Shubham Mahajan
>
> _______________________________________________
> CKAN security
> https://lists.okfn.org/mailman/listinfo/security
> https://lists.okfn.org/mailman/options/security/adria.mercader%40okfn.org
>
> Repo: https://github.com/ckan/ckan-security
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.okfn.org/mailman/private/security/attachments/20190219/daa9da51/attachment-0001.html>