CVE-2015-1174
📋 TL;DR
This session fixation vulnerability in Unit4 Polska TETA Web allows attackers to hijack user sessions by forcing victims to use a predetermined session ID. Attackers can gain unauthorized access to user accounts and perform actions as the victim. Affects TETA Web (formerly TETA Galactica) version 22.62.3.4 and earlier.
💻 Affected Systems
- Unit4 Polska TETA Web
- TETA Galactica
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover leading to data theft, privilege escalation, and unauthorized administrative actions within the application.
Likely Case
Unauthorized access to user accounts, potential data exposure, and session hijacking for authenticated users.
If Mitigated
Limited impact with proper session management controls, but still presents authentication bypass risk.
🎯 Exploit Status
Session fixation attacks are well-documented and relatively easy to execute with basic web security knowledge.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 22.62.3.4
Vendor Advisory: Unknown - Vendor-specific advisory not publicly documented
Restart Required: Yes
Instructions:
1. Contact Unit4 Polska for patch information. 2. Upgrade to version newer than 22.62.3.4. 3. Restart TETA Web services after patching.
🔧 Temporary Workarounds
Session Regeneration on Authentication
allForce session ID regeneration when users authenticate to prevent fixation attacks
Application-specific configuration - consult TETA Web documentation
HTTP Security Headers
allImplement security headers to enhance session protection
Set-Cookie: Secure; HttpOnly; SameSite=Strict
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block session fixation attempts
- Monitor for unusual session patterns and implement additional authentication factors
🔍 How to Verify
Check if Vulnerable:
Check TETA Web version in application interface or configuration files. If version is 22.62.3.4 or earlier, system is vulnerable.Check Version:
Application-specific - check TETA Web admin interface or configuration filesVerify Fix Applied:
Verify version is newer than 22.62.3.4 and test that session IDs are regenerated upon authentication.📡 Detection & Monitoring
Log Indicators:
- Multiple sessions with same ID from different IPs
- Session IDs not changing after login
- Unusual authentication patterns
Network Indicators:
- Session ID parameters in URLs
- Cookie manipulation attempts
- Multiple authentication requests with same session
SIEM Query:
web_application_logs session_id COUNT BY source_ip WHERE session_id IS NOT NULL AND auth_success = true