Executive brief
TreeFrog Framework is a C++ web application framework that manages user sessions via cookies. The framework's cookie session handler uses a flawed string comparison function that stops at null bytes when verifying cryptographic signatures. An attacker can forge session cookies to impersonate any user, including administrators, without knowing the server secret or having valid credentials.
Technical details
The vulnerability is a cryptographic signature verification bypass in the session cookie handler (src/tsessioncookiestore.cpp). The code uses std::strncmp to compare HMAC-SHA3-256 digests, which are raw binary data. Since strncmp is a C string function, it stops comparing at the first null byte (0x00). Approximately 1 in 256 HMAC digests naturally start with 0x00; an attacker can brute-force a forged session payload until this condition occurs, then submit an all-zero digest that passes the flawed check. No authentication, credentials, or server-secret knowledge is required. The attack succeeds with high reliability in ~256 requests. Fix: use memcmp or constant-time comparison instead of strncmp. Patched in version 2.12.1.
Affected products
- TreeFrog Framework TreeFrog Framework 2.9.0 to 2.12.0 (fixed in 2.12.1)
Timeline
- 2026-08-17: disclosed: Public disclosure and CVE assignment
- 2026: patched: Fixed in version 2.12.1