COMMON WEAKNESS ENUMERATIONIncomplete

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Soyutlama

Compound

Yapı

Composite

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

Genişletilmiş açıklama

Such a scenario is commonly observed when: - A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user. - An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session. - The application or container uses predictable session identifiers. In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

Yaşam döngüsü evresi

Implementation

Risk

Başarılı sömürü neye yol açar?

Gain Privileges or Assume Identity

Etkilenen güvenlik alanları: Access Control

Savunma

Nasıl önlenir ve çözülür?

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay
Invalidate any existing session identifiers prior to authorizing a new user session.

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay
For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.

Operation

Firewall

Detay
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

Etkinlik: Moderate

An application firewall might not cover all possible input vectors. In addition, attack techniques might be available to bypass the protection mechanism, such as using malformed inputs that can still be processed by the component that receives those inputs. Depending on functionality, an application firewall might inadvertently reject or modify legitimate requests. Finally, some manual effort may be required for customization.