Description
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| dianping | cat | ≤ 3.1.0 | — |
References
- GitHub Issue #2384 issue-tracking
- https://github.com/dianping/cat product
- TokenBuilder.java at 3.1.0 technical-description
- HttpUtils.java at 3.1.0 technical-description
- VulnCheck Advisory: CAT through 3.1.0 Session Cookie Forgery via Unkeyed hashCode Checksum third-party-advisory