EUVD-2026-70485
GHSA-xrx5-jvp4-rqmj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach CAT web console
-
DeliveryForge cookie with valid hashCode checksum offline
-
ExploitSet x-forwarded-for to bypass IP binding
-
ExecutionSubmit forged admin session
-
ImpactGain full configuration access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V3 - Web Frontend Security Cookie integrity validation
|
| Exploitation Conditions | Requires network reachability to CAT's web/login endpoint (any deployment ≤3.1.0). The attacker needs no credentials and no user interaction: the cookie checksum is Java String.hashCode() with no server-side key, so a valid admin cookie is forged offline, and the IP-binding control is bypassed by setting the client-controlled x-forwarded-for header to an accepted address. The only real limiting factor is exposure - the CAT console must be reachable by the attacker (internet-facing or reachable from the attacker's network position); there is no default-config safeguard that blocks this once the endpoint is reachable. |
| Impact | This is a genuine high-priority issue rather than an inflated CVSS number. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, 9.3) is internally consistent with the description: fully remote, no authentication, no user interaction, and complete admin compromise of the monitoring platform. No EPSS score, KEV listing, or POC flag was provided in the input, so exploitation is not confirmed active - the risk is driven by exploit simplicity, not observed attacks. The offline-forgeable checksum plus header-controlled IP bypass means exploitation is highly automatable once the cookie format is known, and the vulnerable code is publicly readable, which materially raises the practical likelihood. The main tempering factor is deployment footprint: CAT is a niche APM tool, so exposure is narrower than an internet-scale library. Availability impact (VA:H) is somewhat generous - the primary consequences are confidentiality (config/monitoring data) and integrity (config tampering) - but admin control could plausibly disrupt the monitoring service, so it is defensible. |
| Exploit ScenarioDerived | An attacker who can reach the CAT web console offline computes a session cookie whose String.hashCode()-based checksum validates for an admin identity, then sends the forged cookie with an x-forwarded-for header set to an IP the server accepts. CAT treats the request as an authenticated administrator, granting full configuration access without any credentials. No public POC is noted, but the vulnerable code is open source and the attack requires only standard HTTP tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 03, 2026
Session cookie forgery in Dianping CAT (Central Application Tracking) through version 3.1.0 lets remote unauthenticated attackers mint valid administrator sessions. The server uses Java's String.hashCode() as the only integrity check on session cookies without any server-side secret key, so an attacker can compute a matching checksum entirely offline; combining this with a spoofed x-forwarded-for header to defeat IP-binding validation yields a full-access admin session over CAT's configuration. Reported by VulnCheck; no public exploit has been identified at time of analysis, but the technique is fully documented in the advisory and the vulnerable code (TokenBuilder.java, HttpUtils.java) is public.
RemediationAI
No vendor-released fixed version is identified in the provided data; the issue is tracked upstream at https://github.com/dianping/cat/issues/2384 with the vulnerable logic in TokenBuilder.java and HttpUtils.java. Until a patched release is published, the effective fix is to stop trusting client-supplied trust anchors and to key the cookie integrity check with a server-side secret: replace the String.hashCode()-based checksum with an HMAC (e.g., HMAC-SHA256) over the cookie using a per-deployment secret, and stop honoring the x-forwarded-for header for IP-binding unless it originates from a trusted, configured reverse proxy (side effect: legitimate proxied deployments must whitelist their proxy). As compensating controls, restrict network access to the CAT web/admin console to trusted management networks or a VPN (side effect: breaks any intended broad internal access), place CAT behind an authenticating reverse proxy that strips inbound x-forwarded-for and enforces its own auth, and monitor for admin sessions arriving with unexpected source IPs. Review the VulnCheck advisory for the authoritative technical detail.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CAT is Dianping's open-source real-time application performance monitoring/tracing platform (cpe:2.3:a:dianping:cat), widely self-hosted as a centralized dashboard aggregating metrics from many services. The flaw is CWE-565 (reliance on cookies without validation and integrity checking): the login token builder derives a cookie checksum from Java's non-cryptographic String.hashCode(), a deterministic, publicly reproducible 32-bit hash with no secret keying. Because the checksum depends only on values the attacker can guess or control, it provides zero integrity guarantee - anyone can forge a cookie whose checksum validates. A secondary control, source-IP binding, is defeated because CAT trusts the client-supplied x-forwarded-for header (HttpUtils.java) rather than a vetted proxy chain, so the attacker simply declares an allowed IP.
Know when Cat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, no interaction cookie forgery yielding full admin config access; C:H/I:H clear, A:H via admin control over the monitoring service, no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid checksums offline. Attackers can set the x-forwarded-for header to bypass IP binding validation and create admin sessions with full configuration access.
Articles & Coverage 2
Executive ViewAI
Dianping CAT through version 3.1.0 suffers from a critical unauthenticated session forgery vulnerability allowing remote attackers to mint valid administrator credentials without any password or authentication mechanism. No public exploit code has been identified at time of analysis, but the attack technique is fully documented in public advisories, enabling attackers to gain complete access to CAT configuration and monitored application data.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or strictly validate x-forwarded-for headers to prevent IP-binding bypass; implement network segmentation to restrict CAT administrative access to trusted networks only; replace session tokens with server-side cryptographically signed cookies; immediately rotate all administrative credentials; monitor access logs for anomalous session creation or administrative activity; deploy a reverse proxy to enforce additional session validation. Note: these controls provide defense-in-depth but do not eliminate the vulnerability and should be considered temporary measures pending vendor patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7,
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsis
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast!. Rated medium severity (CVSS 4.3), t
The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVir
The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Comodo Antivirus 7424, Emsisoft
The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, For
The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickH
The CAB file parser in Quick Heal (aka Cat QuickHeal) 11.00, Trend Micro AntiVirus 9.120.0.1004, Ikarus Virus Utilities
The CAB file parser in Emsisoft Anti-Malware 5.1.0.1, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Quick
The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Norman Antivirus 6.06.12, and Sophos Anti-Virus 4.61.0 allo
The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Norman Antivirus 6.06.12, and Sophos Anti-Virus 4.61.0 allo
The TAR file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Jiangmin Antivirus 13.0.900, No
Exploit-DB