CVE-2025-53642
📋 TL;DR
This vulnerability in HAXcms backends fails to properly terminate user sessions during logout, allowing attackers to maintain access to authenticated sessions. It affects all users of haxcms-nodejs and haxcms-php backends before version 11.0.6.
💻 Affected Systems
- haxcms-nodejs
- haxcms-php
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could maintain persistent access to compromised accounts, potentially leading to unauthorized content modification, data theft, or privilege escalation.
Likely Case
Session hijacking where attackers can access authenticated user sessions after logout, leading to unauthorized actions within the CMS.
If Mitigated
Limited impact with proper session management controls and monitoring in place.
🎯 Exploit Status
Exploitation requires access to a user session but is trivial once obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.0.6
Vendor Advisory: https://github.com/haxtheweb/issues/security/advisories/GHSA-g4f5-5w5j-p5jg
Restart Required: Yes
Instructions:
1. Update haxcms-nodejs or haxcms-php to version 11.0.6 or later. 2. Restart the application server. 3. Force all users to log out and log back in to invalidate existing sessions.
🔧 Temporary Workarounds
Manual Session Invalidation
allImplement custom session termination logic that clears all session cookies and tokens on logout.
🧯 If You Can't Patch
- Implement strict session timeout policies and force periodic re-authentication
- Monitor for unusual session activity and implement session revocation mechanisms
🔍 How to Verify
Check if Vulnerable:
Check if logout functionality fails to clear session cookies or tokens after logout.Check Version:
Check package.json for haxcms-nodejs or composer.json for haxcms-php versionVerify Fix Applied:
Test logout functionality to ensure all session cookies and tokens are properly cleared.📡 Detection & Monitoring
Log Indicators:
- Multiple successful logins from same session ID after logout
- Unusual session duration
Network Indicators:
- Session cookies persisting after logout requests
SIEM Query:
session_id AFTER logout AND successful_authentication