CVE-2024-34324

Executive Summary

CVE-2024-34324 is a session hijacking vulnerability in ProPhoenix Law RMS (Records Management System) version 2022.2403.3.101. The flaw allows an unauthenticated attacker to take over an authenticated user's session by injecting a crafted 24-character string into the ASP.NET_SessionId cookie, effectively bypassing authentication controls. Law enforcement and public safety agencies running this platform are at risk of unauthorized access to sensitive case, personnel, and evidence data, with no vendor patch currently available (patch confidence 0/4).

Technical Analysis

ProPhoenix Law RMS is a web-based records management platform built on the Microsoft ASP.NET stack, exposed through a web server (typically IIS) and relying on ASP.NET_SessionId cookies for session state management.

The vulnerability class here is session hijacking via cookie manipulation. According to the NVD description, an attacker can execute a session hijacking attack by injecting a crafted 24-character string into the ASP.NET_SessionId cookie. This implies the application fails to properly validate, bind, or regenerate session identifiers in a way that prevents an attacker from assuming another user's session context.

Key technical observations derivable strictly from the description:

• The attack surface is the HTTP session management layer (ASP.NET_SessionId cookie).
• The required payload is character-length constrained: exactly 24 characters.
• The attack is network-accessible and requires no authentication or user interaction, indicating the session identifier space or validation logic is predictable or inadequately bound to the client.

The specific parsing/validation flaw that permits a 24-character injection to yield a valid session is not detailed in the available data. No function names, API endpoints, or code paths are disclosed. It is important not to speculate on internal implementation details beyond what is stated: the core issue is that a crafted 24-character value placed in the ASP.NET_SessionId cookie results in session takeover.

Session hijacking of this nature typically enables an attacker to impersonate whatever privilege context the victim session holds — in a law enforcement RMS, potentially including administrative accounts with elevated access to sensitive records.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2024-34324. The following attack chain is inferred at the vulnerability-class level (session hijacking via cookie injection) and does not rely on fabricated implementation details.

1) Reconnaissance / Target Identification An attacker identifies internet-facing ProPhoenix Law RMS instances using search-engine and Shodan queries for the application's login interface and characteristic HTML signatures. Because the vulnerability requires only network reachability to the web application, any exposed instance of v2022.2403.3.101 is a candidate.

2) Triggering the Flaw The attacker interacts with the web application and, instead of relying on a legitimately issued session identifier, crafts a 24-character string and places it into the ASP.NET_SessionId cookie of an HTTP request. The application fails to reject or properly validate this attacker-supplied value, meaning the crafted cookie is accepted as a valid session reference.

3) Payload / Execution Method (vulnerability-class level) At the class level, the exploitation is a cookie-injection step: the attacker supplies a manipulated ASP.NET_SessionId value. If the application can be made to associate that crafted identifier with a valid or predictable session state — or if the value aligns with another user's session — the attacker's requests are treated as belonging to that authenticated session. The exact mechanism by which the 24-character value maps to a valid session is not disclosed and must not be assumed.

4) Post-Exploitation Impact Once the attacker's requests are accepted under a hijacked session, they inherit the victim's privileges and can read or manipulate records available to that session. In an RMS context this may include sensitive case files, PII, and investigative data. Session integrity is broken, giving the attacker a persistent authenticated foothold until the session expires or is invalidated.

Impact Assessment

Given the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N:

• Attack Vector (Network): exploitable remotely over the network.
• Attack Complexity (Low): no special conditions beyond reaching the application.
• Privileges Required (None): no prior authentication needed.
• User Interaction (None): no victim action required.
• Scope (Unchanged): impact confined to the vulnerable application's security context.
• Confidentiality (High): attacker can access data belonging to the hijacked session.
• Integrity (High): attacker can modify data within that session's authority.
• Availability (None): the flaw does not directly degrade availability.

Blast radius: Any deployment of ProPhoenix Law RMS v2022.2403.3.101 exposed to untrusted networks is at risk. Because the platform serves law enforcement and public safety record-keeping, compromise could expose highly sensitive data (case records, personnel information, investigative detail), create evidentiary integrity concerns, and enable lateral movement toward administrative functionality. The High/High confidentiality and integrity ratings reflect that a hijacked session can both read and alter protected records.

Detection Guidance

Sigma Rule

title: ProPhoenix Law RMS Session Hijacking via Crafted ASP.NET_SessionId Cookie
id: 8f4c2a71-3b9e-4d2a-9c1e-6a7b5d0e1f23
status: experimental
description: Detects requests carrying an ASP.NET_SessionId cookie whose value deviates from the expected format/length, indicative of CVE-2024-34324 session hijacking attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2024-34324
author: valtersit.com Threat Intelligence
date: 2024/05/10
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - 'LawRMS'
      - 'ProPhoenix'
  selection_cookie:
    cs(Cookie)|contains: 'ASP.NET_SessionId='
  condition: selection_uri and selection_cookie
  # Tune by alerting where ASP.NET_SessionId value length != 24 or matches non-hex/abnormal charset
fields:
  - c-ip
  - cs-uri-stem
  - cs(Cookie)
  - sc-status
falsepositives:
  - Legitimate session identifiers that pass through a proxy that rewrites cookies
level: medium

YARA Rule

rule CVE_2024_34324_ProPhoenix_LawRMS_SessionHijack
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects HTTP requests referencing ProPhoenix Law RMS with manipulated ASP.NET_SessionId cookie (CVE-2024-34324)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-34324"
        date = "2024-05-10"
        severity = "high"

    strings:
        $cookie = "ASP.NET_SessionId=" ascii nocase
        $app1   = "ProPhoenix" ascii nocase
        $app2   = "LawRMS" ascii nocase
        $app3   = "Law RMS" ascii nocase

    condition:
        $cookie and any of ($app*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2024-34324 ProPhoenix Law RMS ASP.NET_SessionId Cookie Session Hijack Attempt"; flow:established,to_server; http.cookie; content:"ASP.NET_SessionId="; http.uri; content:"Law"; nocase; reference:cve,2024-34324; reference:url,nvd.nist.gov/vuln/detail/CVE-2024-34324; classtype:attempted-user; sid:10034324; rev:1;)

Elastic Detection

network where
  http.request.method == "GET" and
  http.request.headers contains "Cookie" and
  http.request.headers contains "ASP.NET_SessionId" and
  (http.request.headers contains "LawRMS" or http.request.headers contains "ProPhoenix")

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=access_combined
| search cs_uri_stem="*Law*" OR cs_uri_stem="*ProPhoenix*" OR cs_Cookie="*ASP.NET_SessionId*"
| eval sess=if(match(cs_Cookie,"ASP.NET_SessionId=([^;]{24})"), "len24_flag","other")
| stats count by src_ip, cs_uri_stem, cs_Cookie, status
| where count > 0
| sort -count

Wazuh OSSEC Rule

<group name="web,attack,cve-2024-34324,">
  <rule id="10034324" level="10">
    <if_sid>31100</if_sid>
    <id>^200$|^404$</id>
    <match>ASP.NET_SessionId</match>
    <description>CVE-2024-34324: Possible ProPhoenix Law RMS session hijacking via crafted ASP.NET_SessionId cookie</description>
    <mitre>
      <id>T1539</id>
    </mitre>
    <group>session_hijack,pci_dss_6.5.10,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version advisory has been published.

1) Immediate Mitigations

• Restrict network exposure: place Law RMS behind a VPN, zero-trust access proxy, or IP allowlisting so only trusted networks can reach the application. This directly removes the remote, unauthenticated attack path.
• Enforce TLS and enable the Secure, HttpOnly, and SameSite=Strict attributes on all session cookies via web server / application configuration to reduce cookie tampering and theft surface.
• Deploy network and host detections above (Suricata, Sigma, Wazuh) to catch requests with abnormal ASP.NET_SessionId cookie values.
• Enable short session timeouts and require re-authentication for sensitive actions to limit the window of a hijacked session.
• Monitor application logs for session anomalies, concurrent use of the same session from multiple source IPs, and unexpected privilege activity.

2) Patch / Upgrade Steps

• There is currently no vendor patch. Contact ProPhoenix directly for an advisory, hotfix, or updated build; do not assume a fixed version exists. Until a fix is issued, treat v2022.2403.3.101 as vulnerable and rely on compensating controls.
• When a patched version becomes available, validate it in a staging environment, confirm session handling remediation, then schedule production rollout.

3) Long-Term Hardening

• Implement server-side session binding (tie session identifiers to client attributes) and regenerate session IDs on authentication and privilege changes.
• Adopt a formal vulnerability management cadence with periodic authenticated and unauthenticated web testing for systems that handle sensitive public-sector data.
• Apply defense-in-depth: MFA, least-privilege role design, WAF rules tuned to reject malformed/short session cookies, and full audit logging shipped to a SIEM.
• Establish a vendor risk requirement that critical applications have a defined patch SLA and security contact.

References

• NVD — CVE-2024-34324: https://nvd.nist.gov/vuln/detail/CVE-2024-34324
• MITRE ATT&CK T1539 — Steal Web Session Cookie: https://attack.mitre.org/techniques/T1539/
• CWE-384 — Session Fixation: https://cwe.mitre.org/data/definitions/384.html
• OWASP — Session Management Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html
• ProPhoenix — Vendor product information (contact vendor directly for advisory): https://www.prophoenix.com/

No known threat-actor campaigns or exploit-in-the-wild evidence is currently associated with CVE-2024-34324. The CVE is not listed in CISA KEV, no public PoC/exploit code has been observed, and no Nuclei template is available at the time of writing.