adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-10-30 21:52:00 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Bug Report: Insecure Permissions of Reusable cookie #663

New Issue
Closed
opened 2026-10-05 00:10:01 +02:00 by adam · 10 comments
adam commented 2026-10-05 00:10:01 +02:00
Owner
Copy link
Copy source

Steps to reproduce:

  1. Login with Administrator and get the cookie of administrator

image

  1. Capture Packet and Request for an administrator only page.
    Accessible- [√ ]

image

  1. Now login out and delete all the cookie of administrator

Accessible- [× ]

image

You can see that redirction
But when administrator login again

This cookie can be reuse

image

Accessible- [√ ]

  1. Packet Info
    GET /piwigo/admin.php?page=plugin-LocalFilesEditor HTTP/1.1
    Host: 192.168.233.145
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
    Upgrade-Insecure-Requests: 1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
    Referer: http://192.168.233.145/piwigo/admin.php?page=plugin-TakeATour
    Accept-Encoding: gzip, deflate, sdch
    Accept-Language: zh-CN,zh;q=0.8
    Cookie: pwg_id=8i3dh1pru4mu95g20i6ehajvm3;
    Connection: close

Evironment:

  • Windows XP Professional

  • Apache

  • MySQL

  • PHP 5.4.45

discovered by: topsec(lizhiqiang)

# Steps to reproduce: 1. Login with Administrator and get the cookie of administrator ![image](https://user-images.githubusercontent.com/16974004/27491109-987e4454-5873-11e7-8688-df04fb507b4f.png) 2. Capture Packet and Request for an administrator only page. Accessible- [√ ] ![image](https://user-images.githubusercontent.com/16974004/27491126-b1aca22c-5873-11e7-84d7-e160e257983a.png) 3. Now login out and delete all the cookie of administrator Accessible- [× ] ![image](https://user-images.githubusercontent.com/16974004/27491260-3e4bd9fa-5874-11e7-97ce-952ae0bf2373.png) You can see that redirction But when administrator login again This cookie can be reuse ![image](https://user-images.githubusercontent.com/16974004/27491416-df8e3ede-5874-11e7-8e87-892aee39358b.png) Accessible- [√ ] 4. Packet Info GET /piwigo/admin.php?page=plugin-LocalFilesEditor HTTP/1.1 Host: 192.168.233.145 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36 Referer: http://192.168.233.145/piwigo/admin.php?page=plugin-TakeATour Accept-Encoding: gzip, deflate, sdch Accept-Language: zh-CN,zh;q=0.8 Cookie: pwg_id=8i3dh1pru4mu95g20i6ehajvm3; Connection: close # Evironment: - Windows XP Professional - Apache - MySQL - PHP 5.4.45 discovered by: topsec(lizhiqiang) <!-- github-sync-id:238194441 -->
adam closed this issue 2026-10-05 00:10:02 +02:00
adam commented 2026-10-05 00:10:03 +02:00
Author
Owner
Copy link
Copy source

Thank you @Akityo for this report.

@modus75 does it look like a bug or a security issue to you?

Thank you @Akityo for this report. @modus75 does it look like a bug or a security issue to you? <!-- github-comment-id:311003586 -->
adam commented 2026-10-05 00:10:04 +02:00
Author
Owner
Copy link
Copy source

It depends on what "3. Login out" means. If it's clicking the logout link in piwigo, we definitely have a bug. (or misconfiguration of the server domain and/or path for setting the cookie versus deleting it).
If the link has not been clicked - no bug, normal behaviour

It depends on what "3. Login out" means. If it's clicking the logout link in piwigo, we definitely have a bug. (or misconfiguration of the server domain and/or path for setting the cookie versus deleting it). If the link has not been clicked - no bug, normal behaviour <!-- github-comment-id:311004728 -->
adam commented 2026-10-05 00:10:04 +02:00
Author
Owner
Copy link
Copy source

@modus75 Hi, i did clicked the logout link in piwigo. you can verify it.

@modus75 Hi, i did clicked the logout link in piwigo. you can verify it. <!-- github-comment-id:311854229 -->
adam commented 2026-10-05 00:10:05 +02:00
Author
Owner
Copy link
Copy source

I have just tested. The logout link removes the session data from the database. Even if the cookie is reused, this should recreate a new session data from scratch. (the session data contains login information). So I cannot reproduce...

I have just tested. The logout link removes the session data from the database. Even if the cookie is reused, this should recreate a new session data from scratch. (the session data contains login information). So I cannot reproduce... <!-- github-comment-id:312252206 -->
adam commented 2026-10-05 00:10:06 +02:00
Author
Owner
Copy link
Copy source

I also tested, like @modus75 did and I also see the session being removed.

So I wonder what @Akityo has been able to do with a "deleted session id" :-/ There is no magic here: if the session is deleted on Piwigo side, you won't magically get administrator access by stealing the session id of an administrator that has logged out.

@Akityo can you give more details, by email, not on Github, about the security issue you have found?

I also tested, like @modus75 did and I also see the session being removed. So I wonder what @Akityo has been able to do with a "deleted session id" :-/ There is no magic here: if the session is deleted on Piwigo side, you won't magically get administrator access by stealing the session id of an administrator that has logged out. @Akityo can you give more details, by email, not on Github, about the security issue you have found? <!-- github-comment-id:312261969 -->
adam commented 2026-10-05 00:10:07 +02:00
Author
Owner
Copy link
Copy source

@plegall what's your email address. maybe tomorrow i'm back home , send a video to you . @modus75 It make me confuse now , i remamber before post this report ,i had verify this for twice.

@plegall what's your email address. maybe tomorrow i'm back home , send a video to you . @modus75 It make me confuse now , i remamber before post this report ,i had verify this for twice. <!-- github-comment-id:312280524 -->
adam commented 2026-10-05 00:10:08 +02:00
Author
Owner
Copy link
Copy source

http://piwigo.org/contact :-)

http://piwigo.org/contact :-) <!-- github-comment-id:312281466 -->
adam commented 2026-10-05 00:10:08 +02:00
Author
Owner
Copy link
Copy source

@plegall @modus75
em... embarrassing..
I had to apologize for the false positives , my bad..
yes , it can't be reproduce..

@plegall @modus75 em... embarrassing.. I had to apologize for the false positives , my bad.. yes , it can't be reproduce.. <!-- github-comment-id:312438286 -->
adam commented 2026-10-05 00:10:09 +02:00
Author
Owner
Copy link
Copy source

Fine, I close the issue then. Please next time, send an email about security issues :-)

Fine, I close the issue then. Please next time, send an email about security issues :-) <!-- github-comment-id:312444886 -->
adam commented 2026-10-05 00:10:10 +02:00
Author
Owner
Copy link
Copy source

CVE-2017-9837 was previously assigned for this issue (not requested by me). I'll ask it to be rejected.

CVE-2017-9837 was previously assigned for this issue (not requested by me). I'll ask it to be rejected. <!-- github-comment-id:334921186 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#663