Description
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| cjbi | admin3 | ≤ 3.0.0 | — |
References
- admin3 - session token disclosure through the audit log (PoC) exploit
- LogService.java at 3.0.0 technical-description
- DefaultSessionService.java at 3.0.0 technical-description
- data.sql at 3.0.0 (seeded role permissions) technical-description
- Product product
- VulnCheck Advisory: admin3 through 3.0.0 Session Token Disclosure via Audit Log third-party-advisory