Description
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| suitenumerique | Docs | < 5.4.1 | 5.4.1 |
References
- Researcher write-up technical-description exploit
- reset collaboration connection in cascade for all children patch
- reset_connections is called with the access record's own document id technical-description
- https://github.com/suitenumerique/docs product
- VulnCheck Advisory: Docs before 5.4.1 Stale Collaboration Session After Access Revocation third-party-advisory