CVE-2022-31888
📋 TL;DR
This CVE describes a session fixation vulnerability in osTicket's authentication system. Attackers can fixate session IDs before user login, potentially hijacking authenticated sessions after login. All osTicket instances up to version 1.16.2 are affected.
💻 Affected Systems
- osTicket
📦 What is this software?
Osticket by Enhancesoft
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to authenticated user sessions, potentially compromising administrative accounts and sensitive ticket data.
Likely Case
Attackers hijack user sessions to access ticket information, impersonate users, or perform unauthorized actions within the ticketing system.
If Mitigated
With proper session management controls, impact is limited to potential temporary session hijacking of non-privileged accounts.
🎯 Exploit Status
Exploitation requires attacker to fixate session before victim login, but is straightforward once understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.16.3
Vendor Advisory: https://github.com/osTicket/osTicket/releases/tag/v1.16.3
Restart Required: No
Instructions:
1. Backup your osTicket installation and database. 2. Download osTicket v1.16.3 from GitHub releases. 3. Replace the affected file include/class.auth.php with the patched version. 4. Verify the fix by checking the file contains the session regeneration code from commit 85a76f4.
🔧 Temporary Workarounds
Session Regeneration Workaround
allManually implement session ID regeneration after successful login
Edit include/class.auth.php to add session_regenerate_id(true) after successful authentication
🧯 If You Can't Patch
- Implement web application firewall rules to detect session fixation attempts
- Enforce short session timeouts and require re-authentication for sensitive operations
🔍 How to Verify
Check if Vulnerable:
Check if include/class.auth.php contains session_regenerate_id() call after successful login in login() functionCheck Version:
Check the version number in include/ost-config.php or admin panelVerify Fix Applied:
Verify include/class.auth.php contains session_regenerate_id(true) after successful authentication check📡 Detection & Monitoring
Log Indicators:
- Multiple login attempts with same session ID
- Session ID reuse across different IP addresses
Network Indicators:
- Unusual session ID patterns in authentication requests
SIEM Query:
source="osticket" AND (event="login" AND session_id=*) | stats count by session_id | where count > 1🔗 References
- https://checkmarx.com/blog/securing-open-source-solutions-a-study-of-osticket-vulnerabilities/
- https://github.com/osTicket/osTicket/commit/85a76f403a3a116176d0798f39a4c430181d8364
- https://github.com/osTicket/osTicket/releases/tag/v1.16.3
- https://checkmarx.com/blog/securing-open-source-solutions-a-study-of-osticket-vulnerabilities/
- https://github.com/osTicket/osTicket/commit/85a76f403a3a116176d0798f39a4c430181d8364
- https://github.com/osTicket/osTicket/releases/tag/v1.16.3
