CVE-2024-34324 in Law RMS
Summary
by MITRE • 10/13/2026
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified in ProPhoenix Law RMS version 2022.2403.3.101 represents a critical security flaw within the application's authentication and session management mechanisms, specifically targeting the handling of the ASP.NET_SessionId cookie. This weakness allows an attacker to perform a session hijacking attack by injecting a crafted string consisting of exactly twenty-four characters into this specific HTTP cookie field. The core issue lies in how the server-side logic processes or validates incoming session identifiers, failing to adequately sanitize input or enforce strict length and character constraints that would prevent malicious manipulation. By exploiting this lack of validation, an adversary can potentially manipulate the session state associated with a legitimate user's account without possessing valid credentials for that specific identity.
From a technical perspective, ASP.NET applications typically rely on unique, cryptographically secure random strings to identify active sessions between the client and server. When the application accepts a twenty-four-character string as a valid session identifier without proper verification against existing known sessions or enforcing stricter entropy requirements, it creates an opening for prediction or injection attacks. If the underlying implementation uses weak pseudo-random number generators or fails to bind the session ID securely to other contextual factors such as IP addresses or user-agent strings in a robust manner, attackers can guess or force specific session IDs. This manipulation allows them to assume the identity of another user who is currently authenticated and active within the system, effectively bypassing access controls designed to protect sensitive legal data stored within the RMS platform.
The operational impact of this vulnerability is severe due to the nature of Law Resource Management software, which handles highly confidential client information, case files, billing details, and privileged communications. Successful exploitation enables unauthorized individuals to view private documents, alter case statuses, manipulate financial records, or exfiltrate sensitive data without detection through traditional authentication logs. Since session hijacking occurs after initial authentication has been bypassed via cookie manipulation, standard login monitoring tools may not immediately flag the activity as anomalous if the attacker mimics legitimate user behavior patterns closely enough. This poses significant risks to client confidentiality and regulatory compliance obligations such as those mandated by legal ethics rules or data protection regulations like GDPR or HIPAA, depending on the jurisdiction and specific data types involved.
To mitigate this risk, immediate remediation should focus on strengthening session management practices within the ASP.NET framework configuration. Administrators must ensure that the application enforces strict validation of cookie lengths and character sets, rejecting any input that deviates from expected formats for valid session identifiers. It is crucial to configure the web.config file or equivalent settings to set appropriate timeout values for sessions, ensuring they expire quickly after periods of inactivity. Additionally, enabling secure flags on cookies such as HttpOnly can prevent client-side scripts from accessing the session ID, reducing exposure to cross-site scripting vectors that often facilitate cookie theft. Implementing robust server-side validation that verifies the integrity and existence of every received session identifier against a centralized store is essential. Upgrading to patched versions of ProPhoenix Law RMS where this flaw has been addressed by the vendor remains the most effective long-term solution for restoring security posture.