CVE-2024-55603
📋 TL;DR
This vulnerability allows attackers to use expired session IDs to maintain unauthorized access to Kanboard instances. It affects all Kanboard users running versions before 1.2.43 due to improper session expiration validation in the custom session handler.
💻 Affected Systems
- Kanboard
📦 What is this software?
Kanboard by Kanboard
⚠️ Risk & Real-World Impact
Worst Case
Attackers maintain persistent unauthorized access to user accounts even after sessions should have expired, potentially leading to data theft, privilege escalation, or unauthorized project modifications.
Likely Case
Session hijacking where attackers reuse stolen session IDs beyond their intended lifetime to access user accounts.
If Mitigated
Limited impact with proper session management controls and monitoring, though expired sessions could still be briefly usable.
🎯 Exploit Status
Exploitation requires obtaining valid session IDs through other means (XSS, MITM, etc.), but reuse is trivial once obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.43
Vendor Advisory: https://github.com/kanboard/kanboard/security/advisories/GHSA-gv5c-8pxr-p484
Restart Required: Yes
Instructions:
1. Backup your Kanboard installation and database. 2. Download Kanboard 1.2.43 or later from official sources. 3. Replace existing files with new version. 4. Clear browser sessions. 5. Restart web server.
🔧 Temporary Workarounds
Manual session cleanup
allManually delete expired sessions from database and adjust PHP garbage collection settings
DELETE FROM sessions WHERE expires_at < UNIX_TIMESTAMP()
php -r "session_start(); session_gc();"
🧯 If You Can't Patch
- Implement strict session monitoring and alerting for unusual session durations
- Enforce shorter session timeouts at application level and require frequent re-authentication
🔍 How to Verify
Check if Vulnerable:
Check Kanboard version in admin panel or via 'cat app/constants.php | grep APP_VERSION'Check Version:
grep "APP_VERSION'" app/constants.phpVerify Fix Applied:
Verify version is 1.2.43 or later and test that expired sessions are properly invalidated📡 Detection & Monitoring
Log Indicators:
- Session IDs used beyond their expiration time
- Multiple successful logins with same session ID over extended periods
Network Indicators:
- Repeated requests with same session cookie over long durations
SIEM Query:
source="kanboard.log" AND "session_id" AND duration > 3600🔗 References
- https://github.com/kanboard/kanboard/blob/main/app/Core/Session/SessionHandler.php#L40
- https://github.com/kanboard/kanboard/commit/7ce61c34d962ca8b5dce776289ddf4b207be6e78
- https://github.com/kanboard/kanboard/security/advisories/GHSA-gv5c-8pxr-p484
- https://www.php.net/manual/en/function.session-start.php
- https://www.php.net/manual/en/session.configuration.php#ini.session.gc-divisor
- https://www.php.net/manual/en/session.configuration.php#ini.session.gc-maxlifetime
- https://www.php.net/manual/en/session.configuration.php#ini.session.gc-probability
- https://www.php.net/manual/en/sessionhandlerinterface.gc.php
