GSA Bounty · Report #245833
The user, who was deleted from Github Organization, still can access all functions of federalist, in case he didn't do logout
Summary
Thanks to the 18F team for the great experience, fast fix and the bounty!
This report describes authentication issue, when the user, whose privileges was removed, still could access control panel instruments. Issue was fixed by implementing periodic user permissions checks.
References
How it was found
Description
Hi. I found a non-critical session management bug, which still can have serious impact in some scenarios. When user perform login to the Federalist through Github, federalist checks his Organization ID (but only upon login). When the user was deleted from organization for some reasons, but he was logged in the Federalist (or saved his session cookies), he can still do any action on behalf of organization (create sites, delete sites etc).
Reproduction Steps & POC
- Add a test user to your organization, which have access to the federalist.
- Login to the Federalist.
- Remove the user from organization, or leave organization
- Try to create or delete the site. Federalist doesn't know that this user has no permissions, and will allow him to use functions.
Suggested fix
You should implement Organization ID checking in the requests.
Upon login, the endpoint /v0/me is called (once). But it can be a good idea to call it in a random periods of time and check the organization ID, and in case it will return 403 - invalidate user session.