COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONMITRE canlı kaydı

CAPEC-60

Reusing Session IDs (aka Session Replay)

This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.

Soyutlama

Detailed

Tipik ciddiyet

High

Saldırı ihtimali

High

Saldırıyı anla

Bu saldırı kalıbı nedir?

This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.

Uygulama akışı

Saldırı adım adım nasıl ilerler?

1

Explore

Attack step

The attacker interacts with the target host and finds that session IDs are used to authenticate users.

Attack step

The attacker steals a session ID from a valid user.
2

Exploit

Attack step

The attacker tries to use the stolen session ID to gain access to the system with the privileges of the session ID's original owner.

Gereksinimler

Saldırının gerçekleşmesi için ne gerekir?

Ön koşullar

  • The target host uses session IDs to keep track of the users.
  • Session IDs are used to control access to resources.
  • The session IDs used by the target host are not well protected from session theft.

Gerekli beceri

  • Low: If an attacker can steal a valid session ID, they can then try to be authenticated with that stolen session ID.
  • Medium: More sophisticated attack can be used to hijack a valid session from a user and spoof a legitimate user by reusing their valid session ID.

Gerekli kaynak

MITRE kaydında belirtilmemiş.

Etki

Başarılı saldırı neye yol açar?

Gain Privileges

Etkilenen alanlar: Confidentiality, Access Control, Authorization

Savunma

Nasıl önlenir ve etkisi azaltılır?

1
Always invalidate a session ID after the user logout.
2
Setup a session time out for the session IDs.
3
Protect the communication between the client and server. For instance it is best practice to use SSL to mitigate adversary in the middle attacks ( CAPEC-94 ).
4
Do not code send session ID with GET method, otherwise the session ID will be copied to the URL. In general avoid writing session IDs in the URLs. URLs can get logged in log files, which are vulnerable to an attacker.
5
Encrypt the session data associated with the session ID.
6
Use multifactor authentication.

Gerçek dünya

MITRE örnek olayları

Örnek olay 1Detay
OpenSSL and SSLeay allow remote attackers to reuse SSL sessions and bypass access controls. See also: CVE-1999-0428
Örnek olay 2Detay
Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote attackers with access to the ID to gain privileges as that user, e.g. by extracting the ID from the user's answer or forward URLs. See also: CVE-2002-0258
CAPEC-60: Reusing Session IDs (aka Session Replay) — DayBreach Saldırı Sözlüğü · DayBreach