CVE-2018-1340

Vulnerability

Apache Guacamole versions prior to 1.0.0 store the user's session token in a cookie that lacks the secure flag [1]. This means the cookie can be transmitted over unencrypted HTTP connections if any HTTP requests are made to the same domain, exposing the token to network eavesdropping.

Exploitation

An attacker must be able to eavesdrop on network traffic between the client and the server, such as by being on the same local network or performing a man-in-the-middle attack. When the client makes an unencrypted HTTP request to the Guacamole domain, the attacker can capture the cookie containing the session token.

Impact

Successful exploitation allows the attacker to obtain the user's session token, enabling session hijacking. The attacker can then impersonate the victim and gain unauthorized access to the Apache Guacamole instance with the victim's privileges.

Mitigation

The vulnerability is fixed in Apache Guacamole version 1.0.0 [1]. Users should upgrade to this version or later. No workarounds are documented, and this CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.