SafeLine WAF admin console: math/rand seeded by time enables offline session cookie forgery (CWE-330)

Vulnerability Key Information Summary Vulnerability Overview Title: [Bug] SafeLine WAF Management Console — Session signing key generated by with time-based seeding (CWE-330/CWE-338), enabling offline cookie forgery and full unauthenticated administrator takeover. Nature of the Issue: The SafeLine management console signs session cookies using a 32-character key. However, this key is generated via , which is seeded with , making it fully deterministic. An attacker, knowing only the initial second-level timestamp, can replay the seed offline, recover the key, and forge a valid administrator session cookie, thereby completely taking over the WAF (Web certificates, decision policies, etc.). Scope of Impact Affected Component: — Management Console (Management Console API) Affected Version: The release in the branch, commit mirror. Impact: An unauthenticated remote attacker can recover the key offline and forge an administrator cookie, achieving full unauthenticated administrator takeover. Remediation Generate the key using and store it as raw bytes, independent of any clock (i.e., no longer dependent on a time-based seed). Note: The fix is expected to be available in version 9.4.1. POC / Exploit Code Key Source Code (Vulnerability Points) : : (loads the value and uses it directly as the cookie store key): POC Reproduction Code (go.mod) POC Reproduction Code (main.go) Observed Output (Exact seed instance; second-level variants are identical, with a longer scan time) End-to-End Exploitation For any console: set the recovered/forged value as the session cookie and invoke any privileged endpoint (e.g., , , ) — accepts it as a SuperUser.

Goal Reached Thanks to every supporter — we hit 100%!

SafeLine WAF admin console: math/rand seeded by time enables offline session cookie forgery (CWE-330)

More from this source