CKAN CVE-2025-64100

Exploitable ONLY when the CKAN site is reconfigured to use server-side session storage (e.g. SESSION_TYPE=redis, as shown in the fix's regression test) - the default cookie-based session storage is NOT affected. The attacker must additionally pre-establish a known session identifier in the victim's browser (set a cookie) OR steal the victim's currently-valid session, and the victim must then perform an interactive login (UI:R) for the fixed session to become authenticated. Limiting factors: the non-default configuration requirement, the dependency on a separate cookie-injection/MITM capability, and the required victim login materially shrink the exploitable population and raise attack complexity.

This is a genuine-but-conditional session fixation flaw (CWE-384) whose real-world risk is substantially lower than its 6.1 CVSS might suggest to a scanner. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N) already encodes the two biggest mitigating factors: AC:H reflects the non-default prerequisite (server-side session storage - CKAN ships with cookie-based storage by default, which is NOT affected), and UI:R reflects that the victim must actively log in for the fixed session to be elevated. PR:N confirms the attacker needs no account of their own, but the attacker must FIRST either set a cookie in the victim's browser or steal a currently-valid session, which itself presumes a prior foothold (XSS, MITM, or shared/subdomain cookie control). No EPSS score, no CISA KEV listing, and no public proof-of-concept were provided in the intelligence set - only a vendor GHSA advisory and the fix commit - so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: this is a defensible-priority patch for the subset of CKAN operators running server-side (e.g. Redis) session storage, but it is not a drop-everything issue and should be deprioritized relative to unauthenticated RCE or default-config flaws. Conflict to note: CVSS marks C:H via session/account takeover, yet the input Description frames impact narrowly as session fixation with no direct data-write claim - treat the C:H as account-compromise potential rather than confirmed mass data exposure.

An attacker targets a CKAN portal that has been reconfigured for server-side (e.g. Redis) session storage rather than the default cookie storage. The attacker plants a known session identifier in the victim's browser (for example via a cookie-injection vector or a controlled subdomain) and waits for the victim to authenticate; because the pre-patch code did not regenerate the session id on login, the attacker's pre-set session becomes an authenticated session for the victim's account. No public exploit code was provided in the intelligence set.