Description
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, resume, or DELETE connection endpoints to disrupt live SSH, RDP, VNC, or SFTP sessions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gnmyt | Nexterm | 1.0.6-OPEN-PREVIEW – ≤ 1.2.2-BETA | — |
References
- GitHub Issue #1944 issue-tracking
- https://github.com/gnmyt/Nexterm/pull/1950 issue-tracking patch
- https://github.com/gnmyt/Nexterm/commit/00fdb03eea35adb3dee8169469e897b3c8f30657 patch
- https://github.com/gnmyt/Nexterm/blob/v1.2.2-BETA/server/routes/serverSession.js#L87 technical-description
- https://github.com/gnmyt/Nexterm product
- VulnCheck Advisory: Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes third-party-advisory