Executive brief
Dianping CAT is a performance monitoring and diagnostics platform deeply integrated into Meituan's infrastructure. The platform uses a weak cryptographic hash (Java String.hashCode) to verify session cookies, allowing attackers to forge valid admin sessions offline and gain full configuration access without needing valid credentials or the server's secret key.
Technical details
The vulnerability is a cryptographic weakness in session token integrity verification. CAT's TokenBuilder class uses Java's String.hashCode as the sole integrity check for session cookies, without employing a server-side key or HMAC-based approach. This allows an attacker to compute valid cookie checksums offline through brute force. Additionally, the platform's IP binding validation can be bypassed by setting the x-forwarded-for header, enabling attackers to forge admin sessions with complete configuration access. The attack requires no authentication or special network access—only the ability to send HTTP requests. Fix availability depends on Meituan releasing a patched version using proper cryptographic signatures (e.g., HMAC-SHA256 with a server-side key).
Affected products
- Dianping CAT 3.1.0 and earlier
Timeline
- 2026-09-03: disclosed