External risk intelligence

ProPhoenix Law RMS Session Hijacking via Cookie Injection

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2024-34324

The vulnerability affects a Records Management System (RMS) web application. Such applications are commonly deployed as internet-facing or externally accessible portals for law enforcement and administrative use, making the session management surface a likely target for remote interaction.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An issue in ProPhoenix Law RMS software could allow unauthorized users to take over active user sessions by exploiting a vulnerability in how session information is handled. The primary concern is to confirm if our organization uses this specific software and assess any potential exposure.

Attackers can hijack user sessions.
Critical software vulnerability affecting user access.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted session cookie to the vulnerable web application. This allows them to hijack an existing user's session.

No user interaction required.
Inject a malicious string into the session cookie.
Allows session hijacking.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to hijack an active user session in ProPhoenix Law RMS when supported by the advisory. This may enable unauthorized access to sensitive case management data and system functions.

User sessions could be hijacked.
Attackers inject crafted strings into cookies.
Unauthorized access to case data is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts ProPhoenix Law RMS, suggesting that application owners and the infrastructure or platform teams managing its deployment are the primary points of contact. The initial focus should be on identifying all instances of the affected software, determining their exposure, and confirming business criticality to prioritize remediation efforts and engage the correct owner.

Identify affected system instances.
Verify external reachability and criticality.
Plan targeted remediation with owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ProPhoenix Law RMS?

ProPhoenix Law RMS is a Records Management System designed for law enforcement and public safety agencies. It acts as a centralized database for managing case files, incident reports, and administrative data. Because it handles sensitive information, it is often deployed as a web application to allow authorized personnel to access critical records from various locations.

What does CWE-384 mean for CVE-2024-34324?

CWE-384 refers to Session Fixation or improper session management. In the context of CVE-2024-34324, this means the application fails to properly validate or protect session identifiers. By injecting a specific 24-character string into the ASP.NET_SessionId cookie, an attacker can manipulate how the server recognizes a user, effectively tricking the system into granting them the identity and access privileges of an active, authenticated user.

How is this session hijacking vulnerability triggered?

An attacker triggers this by sending a crafted 24-character string within the ASP.NET_SessionId cookie to the application. The vulnerability does not require the target user to perform any action, such as clicking a link or logging in. Simply reaching the application with the malicious cookie injected is sufficient to initiate the hijack.

Is my ProPhoenix Law RMS instance at risk?

According to Halo Surface Signal, this software is often configured as an internet-facing portal to support remote access, which increases the likelihood of external targeting. If your instance is reachable from the internet, it is exposed to this remote attack vector. Systems isolated within a private, restricted network may have a lower risk profile, but the primary factor is whether the web interface is accessible to unauthorized network traffic.

How should I respond to CVE-2024-34324?

First, locate all servers running ProPhoenix Law RMS v2022.2403.3.101 within your environment. Verify whether these instances are accessible over the internet or through untrusted networks. Once identified, document the business criticality of each system and contact the application owners to coordinate the necessary security updates or configuration changes provided by the vendor to remediate the session management flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.