Session Fixation

Opis

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Such a scenario is commonly observed when:

- A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user.

- An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session.

- The application or container uses predictable session identifiers.

In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.

Skutki

• Access Control

  Gain Privileges or Assume Identity

Zapobieganie

• Architecture and Design

  Invalidate any existing session identifiers prior to authorizing a new user session.

• Architecture and Design

  For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.

• Operation · Firewall

  Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

  Skuteczność: Moderate

Przykłady podatności

• CVE-2022-2820 Website software for game servers does not proprerly terminate user sessions, allowing for possible session fixation

Słabość nadrzędna

• CWE-610 Externally Controlled Reference to a Resource in Another Sphere

Wymaga

• CWE-346 Origin Validation Error
• CWE-472 External Control of Assumed-Immutable Web Parameter
• CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')

Kiedy powstaje

• Architecture and Design
• Implementation

Dotyczy

Not Language-Specific, Web Based, Web Server

Uwagi

Other attack vectors include DNS poisoning and related network based attacks where an attacker causes the user to visit a malicious site by redirecting a request for a valid site. Network based attacks typically involve a physical presence on the victim's network or control of a compromised machine on the network, which makes them harder to exploit remotely, but their significance should not be overlooked. Less secure session management mechanisms, such as the default implementation in Apache Tomcat, allow session identifiers normally expected in a cookie to be specified on the URL as well, which enables an attacker to cause a victim to use a fixed session identifier simply by emailing a malicious URL.

Źródła

1. Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors — Katrina Tsipenyuk, Brian Chess, Gary McGraw, NIST, 2005
2. D3FEND: Application Layer Firewall — D3FEND