CVE-2017-6807

What it actually does

mod_auth_mellon fails to bind session cookies to specific virtual hosts, allowing a cookie issued for one site to be accepted by another site on the same server.

Why it matters to the business

An authenticated user on one hosted application can impersonate themselves on a different application sharing the server, leading to unauthorized access and potential data exposure across multiple services.

How an attack unfolds

An attacker obtains a valid session cookie from one web application protected by mod_auth_mellon, then replays that cookie against a different virtual host on the identical server to bypass authentication on the second site.

How to fix it

Upgrade mod_auth_mellon to version 0.13.1 or later; for Chainguard packages apply cilium-fips-1.15 (and related) 1.15.4-r2 or newer; for the GIT repository apply commit 1851412d77624494014fff406764fc6c2aeba1fc.

How to confirm the fix worked

Confirm the installed package or source matches a listed fixed version; review mod_auth_mellon configuration to ensure cookies are scoped per virtual host after upgrade.

Typical attack path

1. Authenticate to the first vulnerable site and capture the session cookie
2. Identify a second virtual host on the same server also using mod_auth_mellon
3. Submit the captured cookie to the second site
4. Gain authenticated access to the second site without providing credentials

How to detect it

Examine web server access logs for the same session identifier appearing against multiple distinct virtual hostnames from the same client IP in a short time window.

What your security team should do

• Prioritize upgrade of all mod_auth_mellon instances to the fixed versions listed
• Audit server configurations for multiple virtual hosts sharing the same auth module
• Monitor authentication logs for session cookies appearing across unexpected hostnames