CVE-2024-30155
📋 TL;DR
HCL SX fails to set the secure attribute on authorization tokens and session cookies, allowing attackers to potentially steal these cookies via Cross-Site Request Forgery (CSRF) attacks. This affects all users of vulnerable HCL SX installations, potentially compromising user sessions and authentication.
💻 Affected Systems
- HCL SX
📦 What is this software?
Hcl Sx by Hcltech
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies and impersonate authenticated users, gaining unauthorized access to sensitive data and administrative functions.
Likely Case
Attackers could perform CSRF attacks to steal user session cookies, leading to account takeover and unauthorized access to user-specific data.
If Mitigated
With proper CSRF protections and secure cookie handling, impact is limited to potential session fixation attacks.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) but uses well-known CSRF techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched versions
Vendor Advisory: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0120110
Restart Required: Yes
Instructions:
1. Review vendor advisory KB0120110. 2. Apply the recommended patch/update from HCL. 3. Restart HCL SX services. 4. Verify secure attribute is now set on cookies.
🔧 Temporary Workarounds
Enable Secure Cookie Attribute via Configuration
allConfigure web server or application to set Secure attribute on all session and authorization cookies
# Configuration depends on specific deployment - consult HCL documentation
Implement CSRF Tokens
allAdd CSRF protection tokens to all state-changing requests
# Implementation requires code changes - consult development documentation
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block CSRF attempts
- Use browser security headers like SameSite cookies and Content Security Policy
🔍 How to Verify
Check if Vulnerable:
Inspect browser developer tools to check if session/authorization cookies lack the Secure attribute when accessed over HTTPSCheck Version:
Check HCL SX version via administrative interface or consult vendor documentationVerify Fix Applied:
Verify cookies now have Secure attribute set and cannot be transmitted over HTTP📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from same session
- Unusual cookie manipulation patterns
Network Indicators:
- HTTP requests with session cookies (should only be HTTPS)
- CSRF pattern requests
SIEM Query:
source="web_logs" AND (cookie="session" OR cookie="auth") AND protocol="HTTP"