CVE-2021-3311: 
PHP vulnerability analysis and mitigation

An authentication vulnerability was discovered in October CMS through build 471, identified as CVE-2021-3311. The issue allows the reactivation of previously invalidated session IDs after a user logs out and then logs back in. This vulnerability was discovered in February 2021 and affects the authentication behavior implemented in Auth/Manager.php (October Commit, Exploit Analysis).

The vulnerability stems from improper session handling in the logout functionality. When a user logs out, the system only flushes the session attributes using Session::flush() without properly invalidating the session ID. This implementation allows old session tokens to be reactivated upon subsequent logins. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD Database).

If exploited, this vulnerability could allow an attacker who has obtained a user's previous session token to regain unauthorized access to their account after the user logs out and logs back in. This creates a significant security risk as it violates the intended authentication behavior and could lead to unauthorized account access (Exploit Analysis).

The vulnerability requires an attacker to first obtain a victim's session token before it can be exploited. The attack scenario is constrained by a time window, as the token's last use must be within the October CMS framework's default session timeout period of 2 hours. While these conditions make exploitation more difficult, the vulnerability remains significant due to its potential impact (Exploit Analysis).

The vulnerability was patched by replacing Session::flush() with Session::invalidate() in the logout function. This change ensures that old session IDs are properly destroyed and cannot be reactivated. Users should upgrade to a version of October CMS that includes the security fix implemented in commit 642f597 (October Commit).