CVE-2025-24318: Cross-Site Scripting (XSS) Vulnerability

CVE-2025-24318 Overview

CVE-2025-24318 affects the Dario Health platform, where cookie attributes are observable through built-in browser developer tools. The cookie policy fails to enforce restrictive attributes such as HttpOnly, exposing session identifiers to client-side scripts. When combined with a Cross-Site Scripting (XSS) flaw, attackers can read session cookies and hijack authenticated user sessions. The issue is cataloged under [CWE-1004] (Sensitive Cookie Without HttpOnly Flag) and disclosed via CISA Medical Advisory ICSMA-25-058-01.

Critical Impact

Session cookies remain accessible to JavaScript, enabling full session compromise when paired with an XSS vulnerability in the affected web application.

Affected Products

• Dario Health web platform (per CISA advisory ICSMA-25-058-01)
• Associated patient-facing components exposing session cookies
• Any deployment relying on the vendor's default cookie configuration

Discovery Timeline

• 2025-02-28 - CVE-2025-24318 published to NVD alongside CISA medical advisory ICSMA-25-058-01
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24318

Vulnerability Analysis

The application sets session cookies without the HttpOnly attribute. Browsers therefore expose the cookie values to any script executing in the document context. Security practitioners can confirm this behavior directly through the Application or Storage panels in Chrome DevTools, Firefox DevTools, or equivalent inspection utilities.

This weakness is a defense-in-depth failure. On its own, an observable cookie does not grant an attacker access. However, the cookie flag exists specifically to contain the blast radius of injection flaws. Removing that boundary elevates any XSS bug from a scripting nuisance to a full account takeover primitive.

Healthcare platforms carry additional risk because session hijacking can expose protected health information (PHI) and enable manipulation of medical device data streams. The EPSS probability is low, but the impact scenario is well understood and reproducible.

Root Cause

The root cause is an insecure default cookie configuration. Session cookies are issued without HttpOnly, and likely without Secure or a strict SameSite policy. The application relies on network-layer transport protection alone rather than layered cookie hardening. This maps directly to [CWE-1004].

Attack Vector

Exploitation requires an attacker to first land JavaScript execution in the victim's browser session, typically through a reflected or stored XSS payload, a malicious third-party dependency, or a browser extension. Once script executes, the attacker reads document.cookie, exfiltrates the session identifier to an attacker-controlled endpoint, and replays it to impersonate the user. User interaction is required, and attack complexity is high because a separate XSS vector must be present. No verified public exploit is available. See the CISA Medical Advisory ICSMA-25-058-01 for vendor-specific technical detail.

Detection Methods for CVE-2025-24318

Indicators of Compromise

• Outbound HTTP or WebSocket requests from user browsers containing session cookie values in URL parameters or request bodies to unfamiliar domains.
• Authenticated sessions originating from IP addresses or user agents that differ from the legitimate user's baseline within a short time window.
• Unexpected Set-Cookie responses lacking the HttpOnly, Secure, or SameSite attributes during application traffic review.

Detection Strategies

• Inspect application responses with an intercepting proxy or the browser Network panel to confirm which cookies are missing the HttpOnly flag.
• Correlate web application firewall (WAF) logs for XSS payload patterns targeting the affected Dario Health endpoints.
• Alert on concurrent authenticated sessions for a single user account originating from geographically inconsistent sources.

Monitoring Recommendations

• Enable Content Security Policy (CSP) violation reporting to surface injection attempts before they succeed.
• Log all session token issuance and reuse events, retaining source IP, user agent, and TLS fingerprint for correlation.
• Review Data Loss Prevention (DLP) telemetry for cookie strings appearing in outbound requests to non-corporate destinations.

How to Mitigate CVE-2025-24318

Immediate Actions Required

• Contact Dario Health through the vendor contact page to obtain remediation guidance and confirm patch availability.
• Audit any deployed instances to identify session cookies lacking HttpOnly, Secure, and SameSite=Strict attributes.
• Rotate active session identifiers and force re-authentication for privileged accounts until the cookie policy is corrected.

Patch Information

No vendor patch identifier is listed in the NVD entry at the time of writing. Refer to CISA Medical Advisory ICSMA-25-058-01 for the authoritative vendor remediation status and coordinate directly with Dario Health support.

Workarounds

• Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins, reducing XSS exploitability.
• Deploy a reverse proxy or WAF rule that rewrites outgoing Set-Cookie headers to append HttpOnly; Secure; SameSite=Strict where feasible.
• Shorten session lifetime and require step-up authentication for sensitive medical data operations until the underlying cookie flag is fixed.

# Example reverse-proxy header rewrite (NGINX) to enforce cookie hardening
proxy_cookie_flags ~ HttpOnly Secure SameSite=Strict;