CVE-2017-12965
📋 TL;DR
This session fixation vulnerability in Apache2Triad 1.5.4 allows attackers to hijack user sessions by setting the PHPSESSID parameter. Attackers can impersonate legitimate users and gain unauthorized access to web applications. This affects all Apache2Triad 1.5.4 installations with default configurations.
💻 Affected Systems
- Apache2Triad
📦 What is this software?
Apache2triad by Apache2triad
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover leading to data theft, privilege escalation, and full system compromise through authenticated actions.
Likely Case
Unauthorized access to user accounts, session hijacking, and potential data exposure.
If Mitigated
Limited impact with proper session management controls and monitoring in place.
🎯 Exploit Status
Exploit code is publicly available and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch exists. Upgrade to a different, maintained server stack as Apache2Triad is outdated and no longer supported.
🔧 Temporary Workarounds
Implement session regeneration
allRegenerate session IDs after user authentication to prevent fixation attacks
session_regenerate_id(true); // In PHP after successful login
Secure session cookie settings
allConfigure PHP to use secure session cookie parameters
session.cookie_httponly = 1
session.cookie_secure = 1
session.use_only_cookies = 1
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block session fixation attempts
- Migrate to a modern, supported server stack like XAMPP, WAMP, or individual component installations
🔍 How to Verify
Check if Vulnerable:
Check if running Apache2Triad version 1.5.4 and test if session IDs persist after authentication without regeneration.Check Version:
Check Apache2Triad installation directory or control panel for version information.Verify Fix Applied:
Verify session IDs change after successful login and cannot be set via URL parameters.📡 Detection & Monitoring
Log Indicators:
- Multiple session creations from same IP
- Session IDs in URL parameters
- Failed authentication attempts followed by successful login with same session ID
Network Indicators:
- PHPSESSID parameter in URLs
- Session fixation attempts in HTTP requests
SIEM Query:
web.url:*PHPSESSID* OR web.uri:*PHPSESSID*🔗 References
- http://hyp3rlinx.altervista.org/advisories/APACHE2TRIAD-SERVER-STACK-v1.5.4-MULTIPLE-CVE.txt
- http://packetstormsecurity.com/files/143863/Apache2Triad-1.5.4-CSRF-XSS-Session-Fixation.html
- http://www.securityfocus.com/bid/100447
- https://www.exploit-db.com/exploits/42520/
- http://hyp3rlinx.altervista.org/advisories/APACHE2TRIAD-SERVER-STACK-v1.5.4-MULTIPLE-CVE.txt
- http://packetstormsecurity.com/files/143863/Apache2Triad-1.5.4-CSRF-XSS-Session-Fixation.html
- http://www.securityfocus.com/bid/100447
- https://www.exploit-db.com/exploits/42520/
