CVE-2025-27453
📋 TL;DR
This vulnerability allows client-side scripts (like JavaScript) to access the PHPSESSION cookie because the HttpOnly flag is disabled. This affects web applications that use PHP sessions without proper cookie security settings, potentially exposing session tokens to cross-site scripting (XSS) attacks.
💻 Affected Systems
- SICK products using PHP sessions
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies via XSS, leading to full account takeover, unauthorized access to sensitive data, and potential lateral movement within the application.
Likely Case
Session hijacking through XSS attacks where attackers capture valid session tokens to impersonate legitimate users.
If Mitigated
Limited impact if XSS vulnerabilities are already patched and other security controls like CSRF tokens are implemented.
🎯 Exploit Status
Requires existing XSS vulnerability to exploit; cookie theft is straightforward once XSS is present
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown from provided references
Vendor Advisory: https://sick.com/psirt
Restart Required: Yes
Instructions:
1. Apply vendor patch from SICK PSIRT. 2. Restart web server. 3. Verify HttpOnly flag is enabled in session cookies.
🔧 Temporary Workarounds
Enable HttpOnly flag in PHP configuration
allConfigure PHP to set HttpOnly flag on session cookies
session.cookie_httponly = 1 in php.ini
Set HttpOnly flag via session_set_cookie_params
allProgrammatically set HttpOnly flag in PHP code
session_set_cookie_params(0, '/', '', true, true);
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) to mitigate XSS attacks
- Use additional session security measures like short session timeouts and IP binding
🔍 How to Verify
Check if Vulnerable:
Inspect browser developer tools to check if PHPSESSION cookie has HttpOnly flag set to falseCheck Version:
php -v to check PHP version; consult vendor documentation for product versionsVerify Fix Applied:
Verify PHPSESSION cookie shows 'HttpOnly' attribute in browser developer tools after fix📡 Detection & Monitoring
Log Indicators:
- Multiple session creations from same user in short time
- Session IDs appearing in client-side error logs
Network Indicators:
- Unexpected JavaScript making document.cookie calls
- Session tokens transmitted in cleartext
SIEM Query:
source="web_logs" AND (cookie="PHPSESSION" AND NOT http_only)🔗 References
- https://sick.com/psirt
- https://sick.com/psirt
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.endress.com
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
