OWASP / SecurityShepherd

Web and mobile application security training platform
https://owasp.org/www-project-security-shepherd/
GNU General Public License v3.0
1.35k stars 460 forks source link

[LOG] regular fatal errors reported in log #735

Open rudosch opened 2 years ago

rudosch commented 2 years ago

Recently I checked the file security-shepherd.log to see if there were any anomalies. I was then surprised to see a relatively large number of fatal errors like this : FATAL @ 01 Dec 19:34:44,278 https-openssl-nio-8443-exec-7 utils.Validate - User account testuser Attempting Admin functions! (With Valid CSRF Tokens)

After a short analysis, I discovered that this message is regularly issued in connection with the servlet servlets/module/GetModule.java which on line 83 is calling the method utils/Validate.validateAdminSession(ses, tokenCookie, tokenParmeter). In this method, in turn, this fatal error is output on line 274.

I noticed that every time a normal user calls up a module (lesson or challenge) in the menu for viewing, this error is reported. Either this does not represent a fatal error, or something is going wrong in the analysis of the session....