CVE-2025-31952
📋 TL;DR
HCL iAutomate has insufficient session expiration, allowing authentication tokens to remain valid indefinitely unless manually revoked. This affects all users of vulnerable HCL iAutomate installations, potentially enabling unauthorized access to authenticated sessions.
💻 Affected Systems
- HCL iAutomate
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain persistent access to authenticated sessions, potentially compromising administrative functions, accessing sensitive data, or performing unauthorized actions within the iAutomate platform.
Likely Case
Stolen or leaked session tokens remain usable indefinitely, allowing attackers to access the system with the privileges of the compromised user account.
If Mitigated
With proper session management controls, the impact is limited to the duration of legitimate sessions, though token theft remains a concern.
🎯 Exploit Status
Exploitation requires obtaining valid session tokens through other means (phishing, MITM, credential theft).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to vendor advisory for specific patched versions
Vendor Advisory: https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0122646
Restart Required: Yes
Instructions:
1. Review vendor advisory KB0122646. 2. Apply the recommended patch/update from HCL. 3. Restart iAutomate services. 4. Verify session expiration is now enforced.
🔧 Temporary Workarounds
Manual Session Revocation
allImplement manual session revocation procedures and regularly invalidate active sessions
Session Timeout Configuration
allConfigure application-level session timeout settings if available
🧯 If You Can't Patch
- Implement network segmentation to restrict access to iAutomate systems
- Enforce multi-factor authentication and monitor for suspicious session activity
🔍 How to Verify
Check if Vulnerable:
Check if session tokens remain valid beyond expected expiration time by testing with captured tokensCheck Version:
Check iAutomate version through administrative interface or configuration filesVerify Fix Applied:
Verify that session tokens now expire according to configured timeout settings📡 Detection & Monitoring
Log Indicators:
- Unusual session duration patterns
- Multiple concurrent sessions from same user
- Session access from unexpected locations
Network Indicators:
- Repeated authentication attempts with same token
- Session reuse from different IP addresses
SIEM Query:
source="iAutomate" AND (event_type="session" AND duration>3600) OR (user="*" AND ip_change="true" AND session_reuse="true")