Legal Robot · Report #249798
Intercom chat session information persists after logout
Summary
A security researcher discovered that the Intercom chat session was not explicitly cleared when a user logs out. On a shared computer, this could have led to chat information from a previous session being accessible to another user because the Intercom components do not explicitly require a user to be logged in. However, this is considered low risk since an attacker would require script access to the machine and technical skill to re-add Intercom script components to a page and carry over cookies to the new session.
How it was found
Hi team,
While testing i look for session related issues but It seems that The Site is Will protected For such problems But a little Issue related to that i wanted to mention here...
When A user Sign-In to his account he can see a Little chat button on Bottom right corner of the page (After Logging-In) And of he sends a Message to Support by this he is surely going to get reply on same location...
Well when User logs out of his account he can't access the chat after logging-out but if he logs-in back he can again chat...
Now if we get the user Session cookies And Logout the user from his account he can still use that session cookies to access the chat ( Only chat on the login page )
POC:
-
Login to your account at https://app.legalrobot.com/login
-
After that Copy the session cookies from export button on extension ( I used Edit this cookie chrome extension to get the cookies and perform the test ) I an attacker case he can use any Cookei grabber to grab the user cookies depends on attack scenario
-
Now When u will get the cookies from the extension Logout from the account
-
Now Load the page https://app.legalrobot.com/login again and Delete all cookies from your browser regarding the website
-
Now add the cookies again from the Extension from import button, and then go to the page https://app.legalrobot.com/account
-
You will see that the page will take u back to Login page but a little difference it contains the same Chat button on the button that was not present click on that button and You will see that all of the user chats are available their and if u send some message it will still be sent
Fix:
Possible fix Include to make it sure no cookies data from Last session is accessible after logout