Executive brief
CKAN is a data management platform that stores and publishes datasets. A session fixation vulnerability allows an attacker to force a victim to use a predetermined session ID, potentially hijacking user accounts if they can set a cookie or intercept an existing session. This could lead to unauthorized access to sensitive data and administrative functions depending on the victim's privileges.
Technical details
This is a session fixation vulnerability (CWE-384) in CKAN's session management. The vulnerability exists when CKAN is configured with server-side session storage (though the default is cookie-based). An attacker can fix a session ID by either setting a cookie on the victim's browser or stealing a currently valid session token. The attacker then waits for the victim to log in, at which point the pre-determined session ID remains in use, allowing the attacker to use that same session to access the victim's account. The fix involves regenerating session identifiers after each login. This has been patched in CKAN 2.10.9 and 2.11.4.
Affected products
- CKAN CKAN 2.10.0 through 2.10.8, 2.11.0 through 2.11.3
Timeline
- 2025-10-29: disclosed
- 2025-10-29: patched: Patched in CKAN 2.10.9 and 2.11.4