CVE-2026-54364

Executive Summary

CVE-2026-54364 is a session variable injection vulnerability in CentreStack before version 17.4. The flaw allows an unauthenticated attacker to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Due to insufficient input sanitization in the custom session serialization format, the attacker can inject a resellerid session variable, bypassing the IsValidRSession authentication check and gaining unauthorized access to management pages. The CVSS score is 6.5 (Medium), indicating a high integrity impact. No public exploit code or official patch has been released as of this report, but the vendor (Centrestack) has indicated that version 17.4 addresses the issue. Organisations using CentreStack should immediately upgrade to version 17.4 or apply strict input validation and session serialization controls as a workaround.

CVSS Breakdown & Threat Level

• Base Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: High (I:H)
• Availability Impact: None (A:N)

The threat level is elevated due to the no‑authentication requirement and the high integrity impact. An attacker who successfully exploits this vulnerability can obtain persistent access to management pages, potentially leading to full administrative control over the CentreStack instance.

Deep Dive & Mechanics

The vulnerability resides in the SelectProvider.aspx page, which handles the initial authentication step. The AccountName parameter is processed and included in the session serialization without proper sanitisation. The custom session format uses newline (\n) and tab (\t) characters as delimiters between variables. By injecting a resellerid= value followed by a newline, the attacker can append a new session variable to the serialised data. The application later uses IsValidRSession to verify the session, but because the injected resellerid variable is present and its value passes the check, the function returns true, granting unauthorized access.

The exploit flow is as follows:

1. The attacker sends a POST request to SelectProvider.aspx with a crafted AccountName parameter, e.g., AccountName=valid_user%0Aresellerid=attacker_value%09.
2. The URL‑encoded characters %0A (newline) and %09 (tab) are decoded and inserted into the session blob.
3. The session serializer interprets the newline as a delimiter and adds resellerid=attacker_value as a separate variable.
4. When the application calls IsValidRSession, it finds the resellerid variable and assumes the session is valid.
5. The attacker gains access to management pages without providing proper credentials.

This type of attack is a classic session variable injection (a subset of injection attacks) and is not limited to this specific parameter – any unsanitised input that becomes part of a delimited session could be exploited.

Vulnerable vs. Patched Code

The patched code ensures that control characters are stripped before serialization, and the session format is hardened against injection attempts.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target running CentreStack version < 17.4.
• Network access to the SelectProvider.aspx endpoint.

Exploit Steps:

1. Craft a POST request with a manipulated AccountName parameter. The payload must include a newline (%0A) and tab (%09) to inject the resellerid variable.
2. Example using curl:

   curl -X POST "https://target/SelectProvider.aspx" \
        -d "AccountName=legit_user%0Aresellerid=1337%09&Provider=someprovider"
   

   Note: The %0A is a newline, %09 is a tab. The tab is appended to maintain the delimiter syntax expected by the serializer.
3. The server will respond with a new session cookie. Use that cookie to access management pages:

   curl "https://target/Management/Admin.aspx" \
        -H "Cookie: ASP.NET_SessionId=<stolen_or_new_session>"
   

4. If the injection is successful, the management page will be served.

Mitigation for Red Team:
Always obtain explicit written permission before testing in production environments. Use a isolated lab environment for validation.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor web server logs for requests to SelectProvider.aspx containing AccountName with URL‑encoded newline (%0A) or tab (%09).
2. Look for unusual session behavior where a session that was not properly authenticated gains access to management endpoints.
3. Implement input validation on the server side – reject requests where the AccountName parameter contains control characters.
4. Review session storage logs for injection patterns (e.g., resellerid= appearing in session data without prior login).

Honeypot Configuration:
Place a fake management page and log access attempts. Any request arriving without prior authentication is a strong indicator of exploitation.

Indicators of Compromise (IOCs)

• Network Indicators:
  • HTTP POST requests to /SelectProvider.aspx with AccountName containing %0A or %09.
  • Anomalous session cookies being used to access /Management/ or /Admin/ endpoints without prior valid login.
• Log Entries:
  • IIS logs showing POST /SelectProvider.aspx - 200 with a parameter string including %0Aresellerid= or \nresellerid=.
  • Application logs with unexpected session variable resellerid that was not set by normal authentication flow.
• File Indicators:
  • On the server, examine session state files or database entries for resellerid that appears outside normal authentication.
• Endpoint Indicators:
  • Processes making unusual HTTP connections to management pages from non‑admin IPs.
• Best Practice YARA Rule (below) can be used to scan for payloads in web logs or captured network traffic.

Detection Engineering

YARA Rule

rule CentreStack_SessionInjection_CVE_2026_54364 {
    meta:
        description = "Detects crafted AccountName parameter containing newline and tab for CVE-2026-54364"
        author = "Valters IT"
        cve = "CVE-2026-54364"
        date = "2026-01-01"
        severity = "high"
    strings:
        $newline = "%0A" ascii wide
        $tab = "%09" ascii wide
        $inject = "resellerid=" ascii wide
        $param = "AccountName=" ascii wide
    condition:
        all of ($param, $newline, $tab, $inject) or
        all of ($param, $newline, $tab) and $inject at (0..1000)
}

Sigma Rule

title: CentreStack Session Variable Injection Attempt
id: d8f9c6a4-5e2b-11ed-9b6a-0242ac120002
status: experimental
description: Detects HTTP POST requests to SelectProvider.aspx with suspicious AccountName parameter containing newline characters.
author: Valters IT
logsource:
    category: webserver
    product: iis
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/SelectProvider.aspx'
        cs-uri-query|contains: 'AccountName='
        cs-uri-query|contains: '%0A'
        cs-uri-query|contains: 'resellerid='
    condition: selection
falsepositives:
    - Legitimate use of newline characters (unlikely in normal authentication)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2026.54364

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-54364 CentreStack Session Variable Injection"; flow:to_server,established; content:"POST"; http_method; content:"/SelectProvider.aspx"; http_uri; content:"AccountName="; http_client_body; content:"%0A"; fast_pattern; content:"resellerid="; within:100; reference:cve,2026-54364; classtype:attempted-admin; sid:10000001; rev:1;)

Note: Backslashes in the YARA rule above have been replaced with forward slashes per formatting rules. The rules are example detections and should be tested in your environment.

Remediation & Mitigation

Immediate Actions (until patch is applied)

1. Input Validation: Implement a web application firewall (WAF) rule to block requests to SelectProvider.aspx where the AccountName parameter contains URL‑encoded control characters (%0A, %0D, %09).
2. Session Hardening: Override the session serialization on the server to reject any variable names that are not expected (e.g., only allow resellerid if it was set by a legitimate login function).
3. Access Control: Restrict access to management pages via network segmentation or IP whitelisting until the patch is applied.

Permanent Fix

• Upgrade to CentreStack version 17.4 or later. The vendor has released a patched version that sanitises input and strengthens session handling.
• Conduct a code review of any custom session serialization routines used in the application.
• Enable HTTPS to prevent man‑in‑the‑middle interception of session cookies.

Long‑Term Recommendations

• Implement a secure session management library (e.g., using System.Web.SessionState with cryptographic signing).
• Use parameterised or immutable session storage (e.g., ASP.NET Session with IsReadOnly set).
• Regularly scan for CVE updates and subscribe to vendor security advisories.

Valters IT
Securing the digital frontier, one CVE at a time.