TreeFrog Framework: HMAC Session Cookie Forgery Authentication Bypass via std::strncmp NUL Truncation

Vulnerability Overview Title: Authentication Bypass via HMAC Session Cookie Forgery (treefrog-framework) Product: TreeFrog Framework Affected Versions: 2.9.0 and later (introduced on 2023-02-04), fixed in version 2.2.1.1 Component: Cookie session store Severity: Critical CWE: CWE-347 (Improper Verification of Cryptographic Signature) Prerequisites: in Authentication Required: None Summary: This vulnerability allows an attacker to bypass authentication by forging HMAC-SHA256 signed session cookies. The root cause is that the function returns 0 when handling null bytes, allowing any forged payload starting with to pass validation. Attackers do not require any credentials or server keys, with a success rate achieved in an average of 256 requests to forge a session. Impact Scope Any anonymous attacker can forge arbitrary session data to elevate privileges, impersonate any user ID, or inject controlled fields to bypass CSRF checks. No accounts are required on the target, and the server key is neither used nor recovered. The attack requires an average of 256 HTTP requests to successfully forge a session. Remediation Replace with a NUL-safe comparison: In line 247 of , replace with or . For Qt < 6.6, use from OpenSSL or implement a constant-time loop manually. POC Code Detailed Steps 1. Establish Baseline: - Open the application login page and confirm that credentials are required. - Log in as a low-privileged user (e.g., Bob) and confirm that the dashboard loads, displaying the user-level view. - Navigate to the admin panel; the server returns a 403 status. 2. Identify PoC Parameters: - Locate the session cookie name, protected endpoints, and session field names and values. 3. Execute PoC: - Build a session payload from scratch, submitting each payload with a fully zeroed forged digest. - A 403 response indicates the server HMAC does not start with , while a 200 response indicates that stopped at byte 0, meaning the forged session loaded successfully. 4. Confirm Access: - Open the admin panel in a browser using the forged cookie, or observe the 200 response printed by the script. - The server returns a complete admin panel response containing sensitive data, which is inaccessible to unauthenticated users. Root Cause Line 247 of : treats input as a NUL-terminated C string, whereas the 32-byte HMAC digest is not a string. Lines 80-91 of : The condition is inverted; returns true when a match is found, preventing the rejection branch from ever triggering. Timeline Prior to commit (2023-02-04), the comparison was secure. This commit introduced the vulnerability by using for comparison. Seven days earlier (2023-01-28), the algorithm was upgraded to HMAC-SHA3-256, but its binary output made NUL truncation immediately exploitable. Summary This vulnerability allows an attacker to bypass authentication by forging session cookies without requiring any credentials or server keys. The fix involves replacing with a NUL-safe comparison.

Goal Reached Thanks to every supporter — we hit 100%!

TreeFrog Framework: HMAC Session Cookie Forgery Authentication Bypass via std::strncmp NUL Truncation

More from this source