CyberSecBulletin
CVE-2023-28809NVD status: Modified

DS-K1T804AXX: Session Fixation

Published Updated By the CyberSecBulletin desk

CVE-2023-28809 is a high-severity session fixation vulnerability in DS-K1T804AXX from Hikvision, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. The record lists version V1.4.0_build221212 as the first without the flaw, so updating DS-K1T804AXX to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.64% chance of exploitation within 30 days, higher than 51% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update DS-K1T804AXX to V1.4.0_build221212 or a later version.
  2. Update DS-K1T341AXX to V3.2.30_build221223 or a later version.
  3. Update DS-K1T671XXX to V3.2.30_build221223 or a later version.
  4. Read the advisory on hikvision.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
  6. Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.

Affected products and versions

VendorProductAffected versionsFixed in
HikvisionDS-K1T804AXXV1.4.0_build221212 up to, but not including, V1.4.0_build221212V1.4.0_build221212
HikvisionDS-K1T341AXXV3.2.30_build221223 up to, but not including, V3.2.30_build221223V3.2.30_build221223
HikvisionDS-K1T671XXXV3.2.30_build221223 up to, but not including, V3.2.30_build221223V3.2.30_build221223
HikvisionDS-K1T343XXXV3.14.0_build230117 up to, but not including, V3.14.0_build230117V3.14.0_build230117
HikvisionDS-K1T341CV3.3.8_build230112 up to, but not including, V3.3.8_build230112V3.3.8_build230112
HikvisionDS-K1T320XXXV3.5.0_build220706 up to, but not including, V3.5.0_build220706V3.5.0_build220706
HikvisionDs-k1t320efwx FirmwareNot specified in the recordNot stated
HikvisionDs-k1t320efx FirmwareNot specified in the recordNot stated
HikvisionDs-k1t320ewx FirmwareNot specified in the recordNot stated
HikvisionDs-k1t320ex FirmwareNot specified in the recordNot stated
HikvisionDs-k1t320mfwx FirmwareNot specified in the recordNot stated
HikvisionDs-k1t320mfx FirmwareNot specified in the recordNot stated
HikvisionDs-k1t320mwx FirmwareNot specified in the recordNot stated
HikvisionDs-k1t320mx FirmwareNot specified in the recordNot stated
HikvisionDs-k1t341am FirmwareNot specified in the recordNot stated
HikvisionDs-k1t341amf FirmwareNot specified in the recordNot stated
HikvisionDs-k1t341cm FirmwareNot specified in the recordNot stated
HikvisionDs-k1t343ewx FirmwareNot specified in the recordNot stated
HikvisionDs-k1t343ex FirmwareNot specified in the recordNot stated
HikvisionDs-k1t343mwx FirmwareNot specified in the recordNot stated
HikvisionDs-k1t343mx FirmwareNot specified in the recordNot stated
HikvisionDs-k1t671 FirmwareNot specified in the recordNot stated
HikvisionDs-k1t671m FirmwareNot specified in the recordNot stated
HikvisionDs-k1t671mf FirmwareNot specified in the recordNot stated
HikvisionDs-k1t671t FirmwareNot specified in the recordNot stated

Version data comes from the organisation that assigned the CVE; 7 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
NoneNo account or login is needed.
User interaction
RequiredA user must take an action such as opening a file or link.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.17.5HighCNA (hikvision.com)
CVSS 3.17.5HighNVD

Official description

Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

How developers prevent this class of flaw

  • Invalidate any existing session identifiers prior to authorizing a new user session.
  • For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.
  • Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth.

More Session Fixation vulnerabilities (CWE-384)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Session Fixation vulnerabilities

Spotted an error? Tell us.