Insufficient Session Expiration in answerdev/answer

Vulnerability

Overview

The vulnerability is an insufficient session expiration issue in the Answer Q&A platform (prior to version 1.0.6). The root cause is that the logout functionality fails to clear the admin user's session cache from the system's internal storage. Specifically, the UserLogout method in the user controller was missing a call to remove the admin-specific cache entry (RemoveAdminUserCacheInfo), causing the stale session data to remain valid after logout [1][3].

Attack

Vector

To exploit this, an attacker would need to either gain access to a shared system where an administrative user had previously logged in, or obtain a leaked session token. Since the admin cache is not cleared upon logout, an attacker could reuse the old session token to maintain authenticated access as the admin, bypassing the intended logout mechanism. No additional authentication or network privileges are required beyond possessing the stale token [3][4].

Impact

Successful exploitation allows an attacker with a stale admin session token to perform actions with full administrative privileges, including accessing sensitive data, modifying system configurations, or performing other high-privilege operations on the Q&A platform. This completely undermines the session security model, as logout does not effectively revoke the session [1][4].

Mitigation

The issue was fixed in commit cd742b75605c99776f32d271c0a60e0f468e181c, which adds the missing RemoveAdminUserCacheInfo call to the logout path. Users are advised to upgrade to Answer version 1.0.6 or later to ensure that admin sessions are properly invalidated upon logout [3][4].