CVE-2024-58317

Executive Summary

CVE-2024-58317 is a cookie security configuration vulnerability in Kentico Xperience, a .NET-based content management system. The flaw allows attackers to bypass SSL/TLS requirements when setting administration cookies via the web.config file. Specifically, the requireSSL attribute is not properly enforced, meaning that even when configured to require SSL, the application may still set cookies over unencrypted HTTP connections. This can lead to session hijacking, authentication bypass, and exposure of sensitive administrative session tokens. The vulnerability affects .NET Framework projects and has no known patch or public exploit code at this time. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the risk remains significant for unpatched deployments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a .NET Framework configuration issue within the Kentico Xperience CMS. No supply chain package is directly affected.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Unscored)
Vector: UNKNOWN
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: None

Given the lack of a CVSS vector, the threat level is assessed as High due to the potential for session hijacking and authentication bypass in administrative interfaces.

Deep Dive & Mechanics

The vulnerability resides in how Kentico Xperience handles the requireSSL attribute in web.config. In .NET applications, the <httpCookies> element can set requireSSL="true" to ensure cookies are only transmitted over HTTPS. However, due to a flaw in Kentico’s cookie handling logic, this attribute is not consistently enforced when setting administration cookies. Attackers can exploit this by:

1. Intercepting HTTP traffic to the Kentico admin interface.
2. Observing that cookies are set over unencrypted connections despite the configuration.
3. Stealing the session cookie and using it to impersonate an authenticated administrator.

The root cause is likely a misconfiguration or a bug in the cookie-setting code that ignores the requireSSL flag for certain cookie types.

Vulnerable vs. Patched Code

Vulnerable Code (web.config snippet):

<httpCookies httpOnlyCookies="true" requireSSL="true" />

Despite this setting, the application may still set cookies over HTTP.

Patched Code (expected fix):

<httpCookies httpOnlyCookies="true" requireSSL="true" />

Additionally, the application code should explicitly check the request’s IsSecureConnection property before setting cookies.

No official patch is available. Administrators should manually enforce SSL at the web server level (e.g., IIS URL Rewrite) and ensure all cookies are marked as Secure.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a network where Kentico Xperience is deployed.
• Ability to intercept HTTP traffic (e.g., using a proxy like Burp Suite).

Steps:

1. Identify the Kentico admin login page (e.g., /admin).
2. Use a proxy to intercept traffic and observe cookie-setting responses.
3. If cookies are set over HTTP, capture the ASP.NET_SessionId or other authentication cookies.
4. Replay the cookie in a browser to gain unauthorized admin access.

Example interception (Burp Suite):

GET /admin HTTP/1.1
Host: vulnerable-kentico.com

HTTP/1.1 200 OK
Set-Cookie: ASP.NET_SessionId=abc123; path=/; HttpOnly

Note the absence of the Secure flag.

Blue Team

Detection:

• Monitor for cookies without the Secure flag in HTTP responses.
• Alert on any admin session activity over HTTP.

Hunting:

• Search IIS logs for requests to /admin over HTTP.
• Use the following PowerShell to check cookie security:

Get-WebConfigurationProperty -Filter system.web/httpCookies -Name requireSSL

Mitigation:

• Enforce HTTPS via IIS URL Rewrite:

<rule name="Redirect to HTTPS" stopProcessing="true">
  <match url="(.*)" />
  <conditions>
    <add input="{HTTPS}" pattern="^OFF$" />
  </conditions>
  <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
</rule>

• Set requireSSL="true" and Secure flag manually in code.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /admin or other admin paths.
• Cookie: Set-Cookie headers without the Secure flag for admin sessions.
• Logs: IIS logs showing 200 responses for admin pages over HTTP.
• File: web.config with requireSSL="true" but cookies still sent over HTTP.

Detection Engineering

YARA Rule

rule Kentico_Cookie_Security_Bypass {
    meta:
        description = "Detects Kentico Xperience cookie security bypass"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-58317"
    strings:
        $cookie = "Set-Cookie:" nocase
        $secure = "Secure" nocase
    condition:
        $cookie and not $secure
}

Sigma Rule

title: Kentico Cookie Security Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP responses setting cookies without Secure flag for Kentico admin
author: Valters IT
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-stem|startswith: '/admin'
        sc-status: 200
        cs-cookie|contains: 'ASP.NET_SessionId'
    condition: selection
falsepositives:
    - Legitimate HTTP admin access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-58317 Kentico Cookie Security Bypass"; flow:to_server; content:"/admin"; http_uri; content:"Set-Cookie"; http_header; nocase; pcre:"/Set-Cookie:[^;]+(?![^;]*Secure)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Enforce HTTPS at the web server level (IIS URL Rewrite) and ensure all cookies are marked Secure.
2. Configuration: Verify web.config has requireSSL="true" and test with a tool like curl:

   curl -v http://vulnerable-kentico.com/admin
   

3. Code Fix: Modify the application code to explicitly check Request.IsSecureConnection before setting cookies.
4. Monitoring: Implement the Sigma and Suricata rules above to detect exploitation attempts.
5. Vendor Contact: Reach out to Kentico for an official patch. If none is available, consider a WAF rule to block HTTP admin access.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert