[OPENMEETINGS-2739] auth security issue

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 6.2.0
• Fix Version/s: 7.0.0
• Component/s: Security
• Labels: authentication security
• Flags: Important
• Assignee: Maxim Solodovnik
• Reporter: Dennis Zimmt
• Created: 25/May/22 08:26
• Updated: 29/Mar/23 15:29
• Resolved: 26/May/22 04:10

Description

There is a heavy security issue that enables you to to log yourself in as another user.

 

If you start the dialog to invite someone in a private room you can choose a room's title, a user and a password. Then you can generate an invitation url which is supposted to be send via mail to that user to join your room.

That url contains a hash which logs in the invited user automatically.

 

<URL>/openmeetings/hash?invitation=c0fdb7cb-e0bb-4012-95ba-e658fc25c634&language=2

 

So by calling that url by yourself you can log in as that invited user (before actually sending the invitation).

 

 

 

Issue Links

• causes: OPENMEETINGS-2750 When send an invitation from Room, "Generate URL" button is grey