Vulnerability in apache (CVE-2013-10075, CVSS 9.1)

Summary

vulnerability in apache (CVE-2013-10075). Confidential information can be exposed externally.

Original description

The description as published by the source.

Apache::Session versions through 1.94 for Perl re-creates deleted sessions.

The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted.

Source: NIST National Vulnerability Database NVD GitHub Advisory

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

A critical vulnerability exists in Apache::Session versions up to 1.94, where sessions thought to be deleted can be recreated. This issue can lead to unintentional revival of data that should have been deleted, posing a risk of personal information leakage. If such a vulnerability is exploited, it could significantly impact users of online services. Utilizing Apache::Session::Store::DBI is a recommended workaround.

Apache::Session up to version 1.94 is vulnerable to session recreation where deleted sessions can be revived. Attackers can exploit this using Apache::Session::Store::File and Apache::Session::Store::DB_File, risking resurrection of data intended for deletion. Affected version is through 1.94, with no fixed version specified. A recommended workaround is to use a store based on Apache::Session::Store::DBI. The CVSS score is 9.1, indicating possibility of network-based attacks with low complexity, requiring no authentication or user interaction.

❓ What is the problem

Apache::Session versions through 1.94 can recreate deleted sessions, leading to potential data leakage.

📍 Affected scope

Apache::Session::Store::File and Apache::Session::Store::DB_File components.

🔥 Severity

Critical severity, CVSS 9.1 (Network-based attack, low complexity, no authentication, high confidentiality and integrity impact).

🔧 How to fix

Use a database store based on Apache::Session::Store::DBI.

🛡️ Workaround

Apply workaround by switching to Apache::Session::Store::DBI.

🔍 Detection

No specific detection method is provided in the sources.

Related past incidents Similar incidents extracted from past CVEs

CVE-2019-10744

Similar session management flaw in the npm package, leading to session hijacking.

CVE-2015-5254

Apache Tomcat session persistence issue allowing session ID prediction.

CVE-2021-39231

Session fixation vulnerability in certain Ruby on Rails versions.

If this happens at your company Expected impact per business scenario

📌 ECサイトにおけるセッション管理

ユーザーのセッションが侵害され、注文履歴や個人情報が第三者に漏洩する可能性がある。

📌 内部業務システムでの利用

社員のアクセス権が不正に引き継がれ、機密情報が漏洩するリスクがある。

📌 クラウドサービスでのセッション管理

プライベートデータにアクセスするためにセッションが誤って復活し、データ漏洩のリスクが高まる。

Recommended action

即座にApache::Session::Store::DBIへの移行を検討し、実装することを推奨します。

Response actions

Concrete steps and command examples for SOC/SRE teams to execute in order

1
Identify exposure identify
```
grep -r 'apache' . | grep -v node_modules
```
リポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で apache を grep し、稼働しているサービス・バージョンを把握する。
7
Post-deployment verification verify
```
Confirm patched version is live in production
```
パッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2013-10075 libapache-session-perl
Ubuntu UBUNTU-CVE-2013-10075 libapache-session-perl

Vulnerability in apache (CVE-2013-10075)