CVE-2021-3311
📋 TL;DR
CVE-2021-3311 is an authentication bypass vulnerability in October CMS where old session IDs become reactivated after a new login occurs. This allows attackers with knowledge of previously invalidated session IDs to regain unauthorized access to user accounts. All October CMS installations through build 471 are affected.
💻 Affected Systems
- October CMS
📦 What is this software?
October by Octobercms
⚠️ Risk & Real-World Impact
Worst Case
Attackers with captured session IDs can hijack authenticated sessions, potentially gaining administrative access to compromise the entire CMS installation and underlying server.
Likely Case
Session hijacking of user accounts leading to unauthorized access, data theft, and privilege escalation within the CMS.
If Mitigated
Limited impact if session IDs are properly protected and rotated, though the fundamental authentication flaw remains.
🎯 Exploit Status
Exploitation requires knowledge of old session IDs, which could be obtained through various means including network sniffing, XSS, or log exposure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Build 472 and later
Vendor Advisory: https://octobercms.com/forum/chan/announcements
Restart Required: No
Instructions:
1. Update October CMS to build 472 or later via the admin panel or composer. 2. Verify the commit 642f597489e6f644d4bd9a0c267e864cabead024 is present. 3. Clear all existing sessions to invalidate potentially compromised session IDs.
🔧 Temporary Workarounds
Session Management Enhancement
allImplement additional session validation and rotation mechanisms
🧯 If You Can't Patch
- Implement strict session timeout policies and force regular re-authentication
- Monitor and log all session creation/reactivation events for suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check October CMS version in admin panel or via composer show october/system. If version is build 471 or earlier, system is vulnerable.Check Version:
php artisan october:versionVerify Fix Applied:
Verify system is running build 472 or later and check that Auth/Manager.php contains the fix from commit 642f597489e6f644d4bd9a0c267e864cabead024.📡 Detection & Monitoring
Log Indicators:
- Multiple successful logins from same session ID
- Session reactivation events
- Unusual authentication patterns
Network Indicators:
- Reuse of old session tokens in HTTP requests
SIEM Query:
source="*october*" AND (event="session_reactivation" OR (event="login" AND session_id IN known_compromised_sessions))🔗 References
- https://anisiosantos.me/october-cms-token-reactivation
- https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024
- https://octobercms.com/forum/chan/announcements
- https://anisiosantos.me/october-cms-token-reactivation
- https://github.com/octobercms/library/commit/642f597489e6f644d4bd9a0c267e864cabead024
- https://octobercms.com/forum/chan/announcements
