admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
cjbi:admin3
References 6
https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C02_log_sessio…
admin3 - session token disclosure through the audit log (PoC)
https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wete…
LogService.java at 3.0.0
https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/java/tech/wete…
DefaultSessionService.java at 3.0.0
https://github.com/cjbi/admin3/blob/3.0.0/admin3-server/src/main/resources/data…
data.sql at 3.0.0 (seeded role permissions)
https://github.com/cjbi/admin3
Product
https://www.vulncheck.com/advisories/admin3-through-3.0.0-session-token-disclos…
VulnCheck Advisory: admin3 through 3.0.0 Session Token Disclosure via Audit Log