Unauthenticated Session Forgery and Privilege Escalation in CAT

The CAT application suffers from a critical vulnerability (CVE-2026-85181) where session cookie integrity is verified using only the Java String.hashCode method without a server-side secret key. Because hashCode is a deterministic, non-cryptographic function, an attacker can perform offline computation to generate valid checksums for arbitrary session cookies. By manipulating the cookie content, attackers can escalate privileges to an administrative role. Additionally, the application improperly relies on the 'x-forwarded-for' HTTP header to enforce IP-based access controls, allowing attackers to spoof client IPs and bypass secondary security mechanisms. This combination of flaws enables full, unauthenticated takeover of the application configuration and data.

Impact

Successful exploitation allows unauthenticated attackers to forge session cookies, granting them full administrative access to the CAT application. This leads to complete compromise of the system configuration, potential data exfiltration, and full control over application functionality. Given the CVSS score of 9.8, this vulnerability represents a critical risk for any environment exposing CAT to an untrusted network.

Recommendation

Prioritize the immediate update or patching of the CAT application as soon as the vendor provides a secure implementation replacing String.hashCode with a cryptographically secure message authentication code (HMAC). Until a patch is applied, implement strict egress/ingress filtering at the web application firewall (WAF) to block requests that manipulate the 'x-forwarded-for' header from untrusted sources. Audit all administrative sessions for anomalous patterns, specifically looking for session cookies that were not preceded by a standard authentication flow (e.g., POST to /login).