CVE-2025-51306: 
NixOS vulnerability analysis and mitigation

CVE-2025-51306 is a broken session management vulnerability in Gatling Enterprise that allows a user's session token to remain valid and usable after logout, due to the application's stateless session design. All Gatling Enterprise versions below 1.25.0 are affected. The vulnerability was published on August 6, 2025, and is classified under CWE-1259 (Improper Restriction of Security Token Assignment). It carries a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Feedly).

The root cause is Gatling Enterprise's use of stateless session tokens (session cookies) that are never server-side invalidated upon logout — the session can only be revoked by changing the application's encryption secret (Broken Logout PoC). Because sessions are stateless and non-expiring, a second related issue compounds the risk: when a user's permissions are changed or the user account is removed, the old session token continues to grant access with the previous privilege level until a new session is created (Permissions PoC). An attacker who obtains a valid session cookie — for example, via network interception, browser access, or log exposure — can replay it indefinitely to access the application as the original user. No authentication or special privileges are required to exploit a captured token, and the attack vector is network-accessible.

Successful exploitation allows an attacker in possession of a session cookie to maintain unauthorized access to Gatling Enterprise indefinitely after the legitimate user has logged out, bypassing the intended security boundary of the logout action. More critically, removed or de-provisioned users retain full application access as long as they hold a valid session token, meaning access revocation controls are effectively non-functional. This exposes sensitive load-testing configurations, infrastructure credentials, and test results to unauthorized parties, and could allow a former employee or compromised account to continue operating within the platform without detection (Broken Logout PoC, Permissions PoC).

Multiple proof-of-concept write-ups are publicly available on GitHub, published by researcher Flo354, covering both the broken logout scenario and the failure to reflect permission changes (GitHub PoC Repo). There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (0.000280), indicating a low current probability of exploitation in the wild (Feedly).

1. Obtain a valid session cookie: Authenticate to a Gatling Enterprise instance (version < 1.25.0) as any valid user, then capture the session cookie from the browser or via network interception (e.g., using Burp Suite or browser developer tools).
2. Trigger logout: Log out of the application through the normal logout flow, which clears the cookie client-side but does not invalidate it server-side.
3. Replay the session token: Use the captured session cookie in subsequent HTTP requests to the Gatling Enterprise API or web interface (e.g., via curl -H 'Cookie: session=<captured_token>' or by re-injecting the cookie in a browser).
4. Confirm persistent access: Verify that the application accepts the replayed token and returns authenticated responses, granting continued access to application resources, test configurations, and data.
5. Exploit permission gaps (optional): If the target user's account has been removed or downgraded, continue using the old session token to access resources at the previous privilege level, since permission changes are not reflected in existing stateless sessions (Broken Logout PoC, Permissions PoC).

• Network: Authenticated API requests to Gatling Enterprise endpoints originating from IP addresses or user agents inconsistent with the account's normal usage pattern, particularly after a logout event has been recorded.
• Logs: Application access logs showing successful authenticated requests from a session token associated with a user account that has been logged out, deactivated, or deleted — especially if the requests occur well after the logout timestamp.
• Logs: Absence of a new login event between a logout and subsequent authenticated activity for the same session identifier, indicating session token reuse.
• Behavioral: Continued API activity from a user account after an administrator has removed or revoked that account, with no corresponding new authentication event in the logs (Broken Logout PoC, Permissions PoC).

Upgrade Gatling Enterprise to version 1.25.0 or later, which addresses the broken session management by properly invalidating session tokens upon logout (Red Hat CVE). As a temporary workaround for organizations unable to upgrade immediately, rotating the application's encryption secret will invalidate all existing stateless session tokens, forcing all users to re-authenticate (Broken Logout PoC). Additionally, administrators should audit active sessions, enforce short session lifetimes where possible, and monitor for post-logout access attempts as a compensating control.

The vulnerability was noted by RedPacketSecurity on social media shortly after disclosure, and was included in a CISA vulnerability summary for the week of August 4, 2025. No significant vendor statement from Gatling beyond the fix in version 1.25.0 has been publicly documented, and broader community discussion has been limited.