CVE-2009-4655
published 2010-02-26CVE-2009-4655: The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes it easier for remote attackers to hijack sessions via a…
PriorityP354high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
49.86%
98.8th percentile
The dhost web service in Novell eDirectory 8.8.5 uses a predictable session cookie, which makes it easier for remote attackers to hijack sessions via a modified cookie.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| novell | edirectory | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Flag unauthenticated GET /dhost/ requests over SSL on port 8030 that do not carry a valid prior session, especially when the cookie value presented matches a predicted increment of a recently issued cookie. ↗
- ·The exploit module defaults to SSL=true on port 8030; detection rules must inspect TLS-decrypted traffic to observe the cookie values and request patterns. ↗
- ·The predictability check may fail if the target has been patched — the module itself reports this condition, so absence of a uniform delta does not guarantee safety without patch verification. ↗
- ·Only Novell eDirectory 8.8.5 is confirmed vulnerable; other versions may also be affected and should be assessed. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Novell eDirectory 8.8.5 - DHost Weak Session Cookie Session Hijacking (Metasploit)
exploitdb·2010-03-14
CVE-2009-4655 Novell eDirectory 8.8.5 - DHost Weak Session Cookie Session Hijacking (Metasploit)
Novell eDirectory 8.8.5 - DHost Weak Session Cookie Session Hijacking (Metasploit)
---
source: https://www.securityfocus.com/bid/38782/info
Novell eDirectory is prone to a session-hijacking vulnerability.
An attacker can exploit this issue to gain access to the affected application.
Novell eDirectory 8.8.5 is vulnerable; other versions may also be affected.
##
# $Id: edirectory_dhost_cookie.rb 7519 2009-11-14 23:08:27Z hdm $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Novell eDirectory DHOST Predictable Session Cookie',
'Descripti
Metasploit
Novell eDirectory DHOST Predictable Session Cookie
metasploit
Novell eDirectory DHOST Predictable Session Cookie
Novell eDirectory DHOST Predictable Session Cookie
This module is able to predict the next session cookie value issued by the DHOST web service of Novell eDirectory 8.8.5. An attacker can run this module, wait until the real administrator logs in, then specify the predicted cookie value to hijack their session.
No writeups or analysis indexed.
http://osvdb.org/60035http://www.metasploit.com/modules/auxiliary/admin/edirectory/edirectory_dhost_cookiehttp://www.metasploit.com/redmine/projects/framework/repository/entry/modules/auxiliary/admin/edirectory/edirectory_dhost_cookie.rbhttps://exchange.xforce.ibmcloud.com/vulnerabilities/56613http://osvdb.org/60035http://www.metasploit.com/modules/auxiliary/admin/edirectory/edirectory_dhost_cookiehttp://www.metasploit.com/redmine/projects/framework/repository/entry/modules/auxiliary/admin/edirectory/edirectory_dhost_cookie.rbhttps://exchange.xforce.ibmcloud.com/vulnerabilities/56613
2010-02-26
Published