CVE-2025-28244 in Server
Summary
by MITRE • 07/10/2025
Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localStorage, leading to account takeover
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/17/2025
The vulnerability identified as CVE-2025-28244 represents a critical insecure permissions flaw within Alteryx Server version 2023.1.1.460 that specifically targets the local storage mechanism used for session token management. This issue resides in the client-side storage implementation where user session tokens are persisted in localStorage without proper security controls, creating a significant attack surface for remote adversaries. The vulnerability stems from the application's failure to implement appropriate access controls and encryption mechanisms for sensitive session data stored locally on user devices. Attackers can exploit this weakness to directly access and extract valid session tokens from the localStorage, which then enables them to impersonate legitimate users and gain unauthorized access to their accounts.
The technical exploitation of this vulnerability occurs through the manipulation of client-side storage mechanisms where session tokens are stored without proper sanitization or access restrictions. When users interact with Alteryx Server, their session tokens are cached in localStorage for convenience and persistence across browser sessions. However, the insecure implementation fails to establish proper access controls that would prevent unauthorized script execution or direct access to these stored credentials. This flaw aligns with CWE-200, which addresses the exposure of sensitive information, and specifically relates to CWE-532, which covers information exposure through improper error handling, though in this case the exposure occurs through the storage mechanism itself rather than error handling. The vulnerability demonstrates a clear violation of secure coding practices that should ensure sensitive data is properly protected through encryption, access controls, and appropriate storage mechanisms.
The operational impact of this vulnerability extends beyond simple credential theft, as it provides attackers with persistent access to user accounts without requiring additional authentication factors. Once session tokens are extracted from localStorage, attackers can maintain long-term access to compromised accounts, potentially leading to data exfiltration, privilege escalation, and unauthorized modifications to workflows or datasets. This type of account takeover vulnerability is particularly dangerous in enterprise environments where Alteryx Server is used for data analytics and business intelligence operations, as it could enable adversaries to access sensitive business data, manipulate analytical results, or disrupt critical business processes. The persistence of session tokens in localStorage makes this vulnerability particularly concerning because it allows attackers to maintain access even after initial exploitation, creating a sustained threat vector that can be difficult to detect and mitigate.
Organizations utilizing Alteryx Server 2023.1.1.460 must implement immediate mitigations to address this vulnerability, including updating to patched versions of the software where available. Security controls should be implemented to prevent unauthorized access to localStorage through proper browser security policies and content security policy enforcement. The application should be configured to use secure storage mechanisms such as HTTP-only cookies with proper secure flags, or implement additional client-side encryption for sensitive session data. Network-level protections such as web application firewalls should be configured to detect and prevent attempts to access local storage mechanisms through malicious scripts or cross-site scripting attacks. This vulnerability also maps to ATT&CK technique T1531, which covers "Modify System Image", and represents a critical weakness in the application's defense-in-depth strategy. Organizations should conduct comprehensive security assessments to identify other potential insecure storage mechanisms throughout their Alteryx deployment and implement proper session management practices that align with industry standards such as those recommended in NIST SP 800-63B for secure authentication and session handling.