CVE-2021-38823
📋 TL;DR
CVE-2021-38823 is a session management vulnerability in IceHrm where admin session tokens remain valid after logout when accessed from different browsers. This allows attackers to maintain administrative access even after the legitimate user logs out. Organizations using IceHrm 30.0.0 OS are affected.
💻 Affected Systems
- IceHrm
📦 What is this software?
Icehrm by Icehrm
⚠️ Risk & Real-World Impact
Worst Case
An attacker could maintain persistent administrative access to the HR management system, allowing full control over employee data, payroll information, and system configuration.
Likely Case
Unauthorized users could access sensitive HR data and perform administrative actions after legitimate admin logout.
If Mitigated
With proper session invalidation controls, the risk is limited to active sessions only.
🎯 Exploit Status
Exploitation requires initial admin session access but is trivial once obtained
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 30.0.1 OS or later
Vendor Advisory: https://www.navidkagalwalla.com/icehrm-vulnerabilities
Restart Required: Yes
Instructions:
1. Backup current installation. 2. Download IceHrm 30.0.1 OS or later. 3. Replace vulnerable files. 4. Restart web server. 5. Clear all existing sessions.
🔧 Temporary Workarounds
Session Timeout Reduction
allReduce session timeout to minimize window of opportunity
Modify session.gc_maxlifetime in php.ini to 1800 (30 minutes)
Force Session Regeneration
allImplement session regeneration on privilege changes
session_regenerate_id(true); after admin actions
🧯 If You Can't Patch
- Implement strict access controls and monitor admin session activity
- Force all users to re-authenticate after any logout event
🔍 How to Verify
Check if Vulnerable:
Test by logging in as admin in Browser A, opening same session in Browser B, logging out from Browser A, then attempting admin actions in Browser BCheck Version:
Check IceHrm version in admin panel or read version.txt fileVerify Fix Applied:
After patch, repeat test - Browser B session should be invalidated when Browser A logs out📡 Detection & Monitoring
Log Indicators:
- Multiple admin sessions from different IPs/browsers
- Admin actions after logout events
- Session IDs not invalidating on logout
Network Indicators:
- Persistent admin session cookies across logout events
- Unauthorized admin API calls
SIEM Query:
source="icehrm" AND (event="admin_logout" AND subsequent event="admin_action" FROM same_session_id)