Executive brief
HUBzero is a web platform used by scientific and educational institutions to build collaboration hubs. The platform accepts session identifiers from URL query strings and request variables instead of requiring secure cookie-based sessions, allowing attackers to fixate sessions. An attacker can craft a malicious link containing a known session ID, trick a victim into clicking it, and then hijack their account once they authenticate.
Technical details
This is a session fixation vulnerability in HUBzero CMS versions through 2.2.32. The vulnerable session manager component (Hubzero/Session/Manager.php) accepts session identifiers from multiple sources including URL query parameters and POST/GET request variables rather than exclusively from secure HTTP-only cookies. An unauthenticated attacker can obtain a valid session token, embed it in a crafted URL sent to a victim, and when the victim clicks the link and subsequently authenticates, the attacker can use the same session token to access the authenticated session and hijack the victim's account. No user interaction beyond clicking a link is required on the attacker's side. This vulnerability is exploitable over the network without authentication from the attacker.
Affected products
- HUBzero HUBzero CMS through 2.2.32
Timeline
- 2026-09-17: disclosed