Q:

Stealing SSL Session Id can cause any harm?

In SSL handshake, server shares the SessionId in Server Hello message and since there is no encryption yet, so anyone can capture this ?
Is it risky ?

A:

This is not risky.
The session is in ServerHello references a previously established TLS session which can be chosen to resume by the client.
This makes it possible to leave out otherwise repeated handshakes, but with just the session id, an attacker cannot do much.
Even if the attacker previously witnessed the handshake that is now skipped, they would know the configuration parameters (as they are the same) of the session - but not the ephemeral keys that got exchanged during the last handshake, as their transmission was secure in the first place (assuming that TLS was used in the right version and with the right configuration).
The misunderstanding might come from the multiple use of „session“: in TLS, there are sessions - and in HTTP(S), there are sessions as well, sometimes. The session id in the ServerHello is not an HTTP(S) session cookie, though. They are different things altogether.
A TLS session has nothing to do with the session you may know from “http session hijacking”.

