Nexpose Security Console Session Capture

`Product: Nexpose Security Console  
Vendor: Rapid7  
Version: < 5.5.3  
Tested Version: 5.5.1  
Vendor Notified Date: December 19, 2012  
Release Date: January 2, 2013  
Risk: Medium  
Authentication: Access to logs required.  
Remote: Yes  
  
Description:  
Due to a flaw in the way the Nexpose Security Console logs session data,   
it is possible to capture the session of a logged in user.  
This could be especially interesting when using a central logging system   
and system admin have access to logs but not the security console.  
In capturing a user’s session as shown in the proof-of-concept below, an   
attacker can gain access to the already logged in account. Once the   
attacker has this information, they can then hijack the established   
session and impersonate the owner in a variety of contexts.  
  
Exploit steps for proof-of-concept:  
1. Nexpose admin logs in.  
2. While monitoring auth.log, the “Registered session” value is captured.  
3. A request to the security console is made and intercepted using a proxy.  
4. ‘JSESSIONID=<session>’ is replaced by   
‘nexposeCCSessionID=<SESSION-CAPTURED-IN-STEP-2>;time-zone-offset=000.  
5. Success.  
  
Vendor Notified: Yes  
Vendor Response: Quickly escalated and resolved.  
Vendor Update: Remediated in 5.5.4.  
  
Reference:  
CVE-2012-6494  
https://community.rapid7.com/docs/DOC-2065#release5  
https://www.owasp.org/index.php/Session_hijacking_attack  
  
Credit:  
Robert Gilbert  
HALOCK Security Labs  
`