CVE-2014-10399

Vulnerability

The session.lua library in CGILua 5.1.x (2007–2010) contains a bug that causes it to generate the same session ID for every session [1]. This makes the library effectively unusable for secure session management, as all sessions share an identical identifier.

Exploitation

An attacker can simply use the fixed session ID to impersonate any user. No authentication or special network position is required; the attacker only needs to know the predictable ID (which is the same for all sessions) and can then hijack any active session [1].

Impact

Successful exploitation allows remote attackers to hijack arbitrary user sessions, gaining unauthorized access to the victim's authenticated web application context. This can lead to disclosure of sensitive information or unauthorized actions performed under the victim's identity [1].

Mitigation

No official patch has been released for CGILua 5.1.x. The vendor was informed but the vulnerability remains unpatched [1]. Users should avoid using the session.lua library from this version and consider upgrading to a later release with proper session ID generation, or implement a custom session management mechanism.