CVE-2024-49709 Overview
CVE-2024-49709 is a session fixation vulnerability [CWE-384] in Internet Starter, a module of the SoftCOM iKSORIS ticket booking and reservation system. An attacker with access to a victim's browser can plant an arbitrary session cookie. When the victim later authenticates, the attacker reuses the same cookie value to hijack the authenticated session. The system compounds the risk by failing to invalidate prior sessions when new ones are created, extending the exploitation window. SoftCOM addressed the flaw in iKSORIS version 79.0.
Critical Impact
A successful session fixation attack lets an adversary take over an authenticated user account in the iKSORIS Internet Starter module without ever knowing the victim's credentials.
Affected Products
- SoftCOM iKSORIS Internet Starter module, all versions prior to 79.0
- Deployments of the iKSORIS ticket reservation and sales platform exposing the Internet Starter component
- cpe:2.3:a:softcom.wroc:iksoris:*:*:*:*:*:*:*:*
Discovery Timeline
- 2025-04-14 - CVE-2024-49709 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-49709
Vulnerability Analysis
The Internet Starter module accepts and honors client-supplied session cookie values without regenerating the session identifier at authentication. An attacker who can influence the victim's browser, for example through a shared workstation, a cross-site scripting sink on a related domain, or a network-adjacent injection, can pre-set a chosen session cookie. When the victim signs in, the application binds the authenticated session to that attacker-known cookie value. The attacker replays the cookie from their own client and inherits the victim's authenticated context.
The defect is amplified because iKSORIS does not destroy pre-existing sessions when new authentications occur. Multiple valid sessions can therefore reference the same account concurrently, giving the attacker a durable foothold rather than a race with the legitimate user. This behavior maps to the classic session fixation pattern documented in CWE-384: Session Fixation.
Root Cause
The application fails two established session management controls. It does not rotate the session identifier on privilege transition (anonymous to authenticated), and it does not enforce single-session-per-principal or terminate stale sessions when a new login occurs. Both are prerequisites for defense against session fixation and session replay.
Attack Vector
Exploitation requires the attacker to place a specific cookie value in the victim's browser and then wait for the victim to authenticate to the iKSORIS Internet Starter interface. Delivery paths include physical or remote access to the victim's browser, a sibling application that can write cookies to the parent domain, or an active-network position that can inject Set-Cookie responses over unprotected transport. Refer to the CERT.PL advisory for the vendor's coordinated disclosure details.
No public proof-of-concept exploit is listed in Exploit-DB, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.211%.
Detection Methods for CVE-2024-49709
Indicators of Compromise
- Multiple concurrent authenticated sessions for the same iKSORIS user account originating from different source IP addresses or User-Agent strings
- Session cookies that persist unchanged across the pre-login and post-login state for the same browser
- Successful logins immediately preceded by Set-Cookie operations from non-application origins
Detection Strategies
- Correlate application authentication logs with session identifiers to flag any session ID observed before an authentication event and reused after it
- Alert on the same session token appearing from two distinct client fingerprints (IP, User-Agent, TLS JA3) within a short window
- Review web server and reverse proxy logs for anomalous cookie values that do not match the server-issued format for iKSORIS session identifiers
Monitoring Recommendations
- Ingest iKSORIS application logs, reverse proxy access logs, and authentication events into a centralized analytics platform for cross-session correlation
- Baseline the number of active sessions per account and alert on deviations, especially concurrent sessions from geographically disparate sources
- Monitor for account activity that follows an unexpected pattern of cookie reuse across login boundaries
How to Mitigate CVE-2024-49709
Immediate Actions Required
- Upgrade the iKSORIS Internet Starter module to version 79.0 or later, which contains the vendor fix
- Force logout of all active iKSORIS sessions after upgrading to invalidate any attacker-planted cookies
- Audit recent authentication events for signs of session reuse or concurrent logins tied to the same account
Patch Information
SoftCOM patched the vulnerability in iKSORIS version 79.0. Administrators should coordinate the upgrade with the vendor and validate that session identifiers are rotated on authentication after deployment. See the CERT.PL security advisory for the official coordination record and the iKSORIS product page for vendor contact information.
Workarounds
- Terminate active sessions on a schedule and enforce short session lifetimes at the reverse proxy until the patch is applied
- Serve the application exclusively over HTTPS and set the Secure, HttpOnly, and SameSite=Strict attributes on session cookies at the proxy layer to reduce cookie-planting paths
- Restrict access to the Internet Starter interface to trusted networks or behind an authenticating reverse proxy while remediation is in progress
- Educate users to avoid authenticating to iKSORIS from shared or untrusted browsers until the environment is upgraded
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
