Delete user not invalid authentication token through REST APIs

[menghaining]

现在行为

Old authentication token can be used after admin delete the user through REST API. This is CWE-613: insufficient session expiration vulnerability.
PoC

预期行为

Although the admin deletes the user through REST APIs, the user's authentication token needs to be invalidated together.

操作系统

• macOS or Mac OSX
• Windows
• Linux(Debian, CentOS, Ubuntu, etc.)

解决方案

Add invalidate authorization like bearerTokenMgr.delete(authorization); of the deleted user at positions:

• v7:

  cskefu/contact-center/app/src/main/java/com/cskefu/cc/controller/api/ApiUserController.java

  Line 340 in e0992e1

  userRes.delete(user);

• v8:

  cskefu/contact-center/app/src/main/java/com/cskefu/cc/controller/api/ApiUserController.java

  Line 340 in 250e1d5

  userRes.delete(user);

代码版本

v7.x, v8.x