CVE-2026-92414

Executive Summary

CVE-2026-92414 is a session fixation and session reuse vulnerability in the Apache Jackrabbit WebDAV server. The server incorrectly attaches a cached authenticated session to any request containing a matching Lock-Token, TransactionId, SubscriptionId, or If-header field token, without performing any credential check. This affects Apache Jackrabbit versions 2.20.0 through 2.20.17, 2.22.0 through 2.22.4, and 2.23.0 through 2.23.5. Successful exploitation allows an unauthenticated attacker to hijack a valid authenticated session and gain unauthorized access to protected WebDAV resources, leading to high confidentiality and integrity impact.

Technical Analysis

The vulnerability resides in the Apache Jackrabbit WebDAV server's session management logic. WebDAV (Web Distributed Authoring and Versioning) extends HTTP with methods such as LOCK, UNLOCK, PROPFIND, and PROPPATCH, and uses headers including Lock-Token, TransactionId, SubscriptionId, and If to manage stateful operations.

According to the NVD description, the Jackrabbit WebDAV server maintains a cache of authenticated sessions. When a request arrives, the server attempts to associate the request with an existing session by matching a token provided in one of the following headers: Lock-Token, TransactionId, SubscriptionId, or If. The critical flaw is that this association is performed based solely on the token value matching a cached session, without any re-validation of the requester's credentials (e.g., session cookie, authentication header, or source IP binding). This is classified as CWE-384: Session Fixation.

Session fixation typically occurs when an application accepts a session identifier from an untrusted source and later elevates that session to an authenticated state. In this case, the "session identifier" is the WebDAV token (Lock-Token, TransactionId, etc.). An attacker who can observe, guess, or obtain a valid token from an authenticated user's session can craft a request containing that token. The Jackrabbit server will then attach the cached authenticated session to the attacker's request, effectively granting the attacker the privileges of the original user.

The attack surface is the WebDAV endpoint exposed by Apache Jackrabbit. This is often reachable over HTTP/HTTPS on standard web ports (e.g., 8080, 80, 443) depending on deployment. The vulnerability requires network access to the WebDAV service, but no prior authentication. The complexity is low because the attacker only needs to supply a valid token in a header; no special conditions or race conditions are described.

The root cause is a missing credential check in the session lookup logic. The server presumably maps tokens to session objects in a cache and returns the session for any request presenting a matching token. Proper session management should verify that the request originates from the same client that originally authenticated, typically via a session cookie or other unforgeable credential. By omitting this check, the server allows any client with knowledge of a token to assume the associated session.

No specific function names, class names, or file paths are provided in the NVD description. Therefore, the analysis remains at the vulnerability-class level: a broken authentication/session management flaw in the WebDAV token handling mechanism.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (session fixation/reuse) and the limited technical details available. No public proof-of-concept exists, and the exact token generation and cache implementation are not described.

1. Reconnaissance and target identification: The attacker identifies an Apache Jackrabbit WebDAV server exposed to the network. This can be done via Shodan searches for "Apache Jackrabbit" or "Jackrabbit WebDAV", or by scanning for WebDAV-enabled endpoints. The attacker confirms the service is running a vulnerable version (2.20.0-2.20.17, 2.22.0-2.22.4, or 2.23.0-2.23.5).

2. Token acquisition: The attacker must obtain a valid Lock-Token, TransactionId, SubscriptionId, or If-header token associated with an authenticated user's session. Possible methods include:

   • Intercepting unencrypted HTTP traffic (if WebDAV is not using TLS) to capture headers containing these tokens.
   • Social engineering to trick a user into revealing a token (e.g., via a malicious link or script).
   • Predicting or brute-forcing weak token values if the token generation is insufficiently random (not specified in the description).
   • Leveraging a separate information disclosure vulnerability to read token values from logs or responses.

3. Session hijacking: With a valid token, the attacker sends a crafted WebDAV request (e.g., PROPFIND, LOCK, or any method that accepts the relevant header) to the vulnerable server. The request includes the token in the Lock-Token, TransactionId, SubscriptionId, or If header. Because the server performs no credential check, it attaches the cached authenticated session to the request. The attacker now operates with the privileges of the original user.

4. Post-exploitation impact: The attacker gains unauthorized access to WebDAV resources. Depending on the original user's permissions, the attacker can read, modify, or delete files and metadata. This could lead to data theft, data tampering, or further lateral movement within the application or underlying repository. The integrity and confidentiality of the system are compromised. No privilege escalation beyond the hijacked session is described, but the attacker could use the access to plant backdoors or exfiltrate sensitive content.

Note: The exact header syntax and token format are not detailed in the NVD description. The attack chain is therefore described at the vulnerability-class level. No public exploit code or PoC is available.

Impact Assessment

The CVSS score is not provided (N/A), so a qualitative assessment is necessary. Based on the vulnerability characteristics:

• Confidentiality: High — an attacker can access any resource available to the hijacked session, potentially exposing sensitive data.
• Integrity: High — the attacker can modify or delete resources within the scope of the hijacked session.
• Availability: None or Low — the vulnerability does not directly cause denial of service, though data destruction could impact availability.
• Attack Vector: Network (AV:N) — the WebDAV service is typically network-accessible.
• Attack Complexity: Low (AC:L) — no special conditions are described; the attacker only needs a valid token.
• Privileges Required: None (PR:N) — the attacker does not need to authenticate.
• User Interaction: None (UI:N) — the attacker does not need a user to perform any action beyond normal use (though token acquisition may require interception, which is not user interaction in the CVSS sense).

The blast radius includes any organization running Apache Jackrabbit in a WebDAV configuration. Given Jackrabbit's use as a content repository in enterprise CMS, document management, and collaboration platforms, the impact could be significant. Affected systems may store business-critical documents, configuration data, or user-generated content. A successful attack could lead to data breaches, regulatory compliance violations (e.g., GDPR, HIPAA), and reputational damage. The lack of a CISA KEV listing and no known active exploitation suggests the immediate risk is moderate, but the vulnerability is trivial to exploit once a token is obtained.

Detection Guidance

Sigma Rule

title: Apache Jackrabbit WebDAV Session Fixation Attempt
id: 9a4b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects requests to Apache Jackrabbit WebDAV server with Lock-Token, TransactionId, SubscriptionId, or If headers that may indicate session fixation attempts.
author: Threat Intelligence
date: 2026-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method:
      - 'PROPFIND'
      - 'PROPPATCH'
      - 'LOCK'
      - 'UNLOCK'
      - 'MOVE'
      - 'COPY'
      - 'DELETE'
      - 'PUT'
  selection_headers:
    - cs-header|contains: 'Lock-Token:'
    - cs-header|contains: 'TransactionId:'
    - cs-header|contains: 'SubscriptionId:'
    - cs-header|contains: 'If:'
  condition: selection_method and selection_headers
falsepositives:
  - Legitimate WebDAV clients using these headers with valid sessions.
level: medium
tags:
  - attack.t1190
  - cve.2026.92414

YARA Rule

rule CVE_2026_92414_Jackrabbit_Session_Fixation
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-92414 in Apache Jackrabbit WebDAV via suspicious header patterns"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92414"
        severity = "high"

    strings:
        $h1 = "Lock-Token:" nocase
        $h2 = "TransactionId:" nocase
        $h3 = "SubscriptionId:" nocase
        $h4 = "If:" nocase
        $method1 = "PROPFIND" nocase
        $method2 = "PROPPATCH" nocase
        $method3 = "LOCK" nocase
        $method4 = "UNLOCK" nocase
        $jackrabbit = "Jackrabbit" nocase

    condition:
        $jackrabbit and any of ($h*) and any of ($method*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92414 Apache Jackrabbit WebDAV Session Fixation Attempt"; flow:to_server,established; content:"Lock-Token|3a|"; http_header; nocase; content:"PROPFIND"; http_method; nocase; sid:10000001; rev:1; reference:cve,2026-92414; classtype:attempted-user;)
alert http any any -> any any (msg:"CVE-2026-92414 Apache Jackrabbit WebDAV Session Fixation Attempt (TransactionId)"; flow:to_server,established; content:"TransactionId|3a|"; http_header; nocase; content:"LOCK"; http_method; nocase; sid:10000002; rev:1; reference:cve,2026-92414; classtype:attempted-user;)
alert http any any -> any any (msg:"CVE-2026-92414 Apache Jackrabbit WebDAV Session Fixation Attempt (SubscriptionId)"; flow:to_server,established; content:"SubscriptionId|3a|"; http_header; nocase; content:"PROPPATCH"; http_method; nocase; sid:10000003; rev:1; reference:cve,2026-92414; classtype:attempted-user;)

Elastic Detection

sequence by process.entity_id
  [process where event.type == "start" and process.name == "java" and process.args : "*jackrabbit*"]
  [network where event.type == "connection" and network.transport == "tcp" and network.direction == "outbound" and process.name == "java"]

Note: The above EQL is a generic heuristic to detect Java processes related to Jackrabbit. A more specific EQL would require parsing HTTP headers in network logs, which is not natively supported in EQL. For precise detection, use a SIEM with HTTP parsing.

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=apache_access
| search (method=PROPFIND OR method=PROPPATCH OR method=LOCK OR method=UNLOCK OR method=MOVE OR method=COPY OR method=DELETE OR method=PUT)
| rex field=request "^(?:[A-Z]+) (?<url>\S+)"
| eval has_lock_token=if(match(_raw, "(?i)Lock-Token:"), 1, 0)
| eval has_transaction_id=if(match(_raw, "(?i)TransactionId:"), 1, 0)
| eval has_subscription_id=if(match(_raw, "(?i)SubscriptionId:"), 1, 0)
| eval has_if_header=if(match(_raw, "(?i)\bIf:"), 1, 0)
| where (has_lock_token=1 OR has_transaction_id=1 OR has_subscription_id=1 OR has_if_header=1)
| stats count by src_ip, method, url, status
| sort -count

Wazuh OSSEC Rule

<group name="web,apache,jackrabbit,">
  <rule id="100001" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <field name="method">PROPFIND|PROPPATCH|LOCK|UNLOCK|MOVE|COPY|DELETE|PUT</field>
    <match>Lock-Token:|TransactionId:|SubscriptionId:|If:</match>
    <description>CVE-2026-92414: Possible Apache Jackrabbit WebDAV session fixation attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_92414,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network access to the Jackrabbit WebDAV endpoint to trusted clients only (e.g., via firewall rules, VPN, or IP allowlisting).
   • Enforce TLS for all WebDAV traffic to prevent token interception.
   • Monitor logs for anomalous WebDAV requests containing Lock-Token, TransactionId, SubscriptionId, or If headers from unexpected sources.
   • If feasible, disable WebDAV functionality until a patch is available, or migrate to an alternative content repository.

2. Patch/upgrade steps:

   • The vendor recommends upgrading to Apache Jackrabbit 2.23.6, 2.22.5, or 2.20.18, which fix the issue (per the NVD description). However, no patch evidence from tracked sources is currently available; verify the availability and integrity of these versions from the official Apache Jackrabbit distribution channels before applying.
   • After upgrading, invalidate all existing sessions and tokens to prevent any lingering hijacked sessions.

3. Long-term hardening:

   • Implement proper session validation: ensure that any session lookup based on tokens also verifies the client's authentication credentials (e.g., session cookie, TLS client certificate, or source IP binding).
   • Adopt a robust session management framework that prevents fixation by regenerating session identifiers upon authentication and rejecting externally supplied session tokens.
   • Conduct regular security audits and penetration testing of WebDAV endpoints.
   • Subscribe to Apache Jackrabbit security advisories and monitor CVE feeds for future vulnerabilities.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-92414
• Apache Jackrabbit Security Advisory (check official Apache site for CVE-2026-92414)
• CWE-384: Session Fixation — https://cwe.mitre.org/data/definitions/384.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• No known threat actor campaigns or exploit-in-the-wild evidence as of this report. CISA KEV: NO.