~/news/2026-09-16-safeline-session-key-from-install-clock.md

What happened. Chaitin's SafeLine WAF derives the secret that signs its administrator session cookies from Go's math/rand, seeded with the install clock. CVE-2026-92749 covers every release through 9.4.1 and rates it 9.2 critical. The attack is guessing which nanosecond the console first started.

Why it matters. Owning a firewall console is not the same as owning the site behind it. The console is where certificates get loaded, upstreams get repointed, and detection gets switched off, so the prize is the ability to unprotect everything else. It is a key-management failure, not a coding error: a key was derived from a value strangers can read.

Mechanism. utils.RandStr reseeds the global random source from time.Now().UnixNano() and returns 32 characters. option.go calls it once at first boot to create the session secret, and main.go hands that string to gorilla/sessions.NewCookieStore. With one key, that store HMAC-SHA256 signs cookies and does not encrypt them, so the body, a user id, is known and only the key is secret. The installer sets the console TLS certificate's NotBefore to the install time, and the console serves it, so the second is readable without authenticating. A billion nanosecond offsets remain, each derived and tested against a captured signed cookie. The reporter measured the unoptimised search at roughly 1e5 candidates per second on one core. The result is a forged administrator cookie and no log entry.

What to do. Take the console off the internet and behind a VPN or allowlist, which removes the reachability and the certificate that leaks the second. Patching the generator is not enough on its own: the key is written once with an insert that does nothing if the row already exists, so an install that predates the fix keeps its recoverable secret until that stored value is replaced. Check the stored value, regenerate it, and treat existing sessions and recent policy changes as suspect: the forgery leaves no failed login.