{"action":"closed","issue":{"url":"https://api.github.com/repos/contrast-community/spring-petclinic/issues/46","repository_url":"https://api.github.com/repos/contrast-community/spring-petclinic","labels_url":"https://api.github.com/repos/contrast-community/spring-petclinic/issues/46/labels{/name}","comments_url":"https://api.github.com/repos/contrast-community/spring-petclinic/issues/46/comments","events_url":"https://api.github.com/repos/contrast-community/spring-petclinic/issues/46/events","html_url":"https://github.com/contrast-community/spring-petclinic/issues/46","id":330500587,"node_id":"MDU6SXNzdWUzMzA1MDA1ODc=","number":46,"title":"CONTRAST: Session Rewriting Allowed in Application or Server Configuration","user":{"login":"planetlevel","id":2704076,"node_id":"MDQ6VXNlcjI3MDQwNzY=","avatar_url":"https://avatars1.githubusercontent.com/u/2704076?v=4","gravatar_id":"","url":"https://api.github.com/users/planetlevel","html_url":"https://github.com/planetlevel","followers_url":"https://api.github.com/users/planetlevel/followers","following_url":"https://api.github.com/users/planetlevel/following{/other_user}","gists_url":"https://api.github.com/users/planetlevel/gists{/gist_id}","starred_url":"https://api.github.com/users/planetlevel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/planetlevel/subscriptions","organizations_url":"https://api.github.com/users/planetlevel/orgs","repos_url":"https://api.github.com/users/planetlevel/repos","events_url":"https://api.github.com/users/planetlevel/events{/privacy}","received_events_url":"https://api.github.com/users/planetlevel/received_events","type":"User","site_admin":false},"labels":[{"id":940597332,"node_id":"MDU6TGFiZWw5NDA1OTczMzI=","url":"https://api.github.com/repos/contrast-community/spring-petclinic/labels/bug","name":"bug","color":"d73a4a","default":true}],"state":"closed","locked":false,"assignee":{"login":"planetlevel","id":2704076,"node_id":"MDQ6VXNlcjI3MDQwNzY=","avatar_url":"https://avatars1.githubusercontent.com/u/2704076?v=4","gravatar_id":"","url":"https://api.github.com/users/planetlevel","html_url":"https://github.com/planetlevel","followers_url":"https://api.github.com/users/planetlevel/followers","following_url":"https://api.github.com/users/planetlevel/following{/other_user}","gists_url":"https://api.github.com/users/planetlevel/gists{/gist_id}","starred_url":"https://api.github.com/users/planetlevel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/planetlevel/subscriptions","organizations_url":"https://api.github.com/users/planetlevel/orgs","repos_url":"https://api.github.com/users/planetlevel/repos","events_url":"https://api.github.com/users/planetlevel/events{/privacy}","received_events_url":"https://api.github.com/users/planetlevel/received_events","type":"User","site_admin":false},"assignees":[{"login":"planetlevel","id":2704076,"node_id":"MDQ6VXNlcjI3MDQwNzY=","avatar_url":"https://avatars1.githubusercontent.com/u/2704076?v=4","gravatar_id":"","url":"https://api.github.com/users/planetlevel","html_url":"https://github.com/planetlevel","followers_url":"https://api.github.com/users/planetlevel/followers","following_url":"https://api.github.com/users/planetlevel/following{/other_user}","gists_url":"https://api.github.com/users/planetlevel/gists{/gist_id}","starred_url":"https://api.github.com/users/planetlevel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/planetlevel/subscriptions","organizations_url":"https://api.github.com/users/planetlevel/orgs","repos_url":"https://api.github.com/users/planetlevel/repos","events_url":"https://api.github.com/users/planetlevel/events{/privacy}","received_events_url":"https://api.github.com/users/planetlevel/received_events","type":"User","site_admin":false}],"milestone":null,"comments":0,"created_at":"2018-06-08T02:45:22Z","updated_at":"2018-11-29T17:03:34Z","closed_at":"2018-11-29T17:03:34Z","author_association":"COLLABORATOR","body":"**Trace ID**: HWY1-H2NK-SRIP-P4KB\n\n**Trace Link**: https://apptwo.contrastsecurity.com/Contrast/static/ng/index.html#/d3b189b6-c17d-46e8-b56e-4ba40794630e/applications/bc014c44-e92b-4bdf-9939-a3b1300c57d8/vulns/HWY1-H2NK-SRIP-P4KB\n\nWhat Happened: \nThe Application or Server Configuration allowed browsers that don't support cookies to rewrite session IDs into the URL as shown in the following URI:\n{code}URI: /resources/css/petclinic.css;jsessionid=F4694E88EE928C543F80D48ED688A769\nReferrer: http://localhost:8080/{code}\n\n\n## Summary\nThe application allows browsers that don&#39;t support cookies to rewrite session IDs into the URL. Having this ability presents a few problems. The first, most basic problem is that the session ID, which is as good as a username and password, is logged in the following places, which log the complete URL:\n\t- Browser history\n\t- Server logs\n\t- Proxy logs\n\nThey&#39;ll also be sent in the &quot;Referer&quot; header to any off-site resources in pages. Normally, session IDs are a secret. If an attacker can steal a victim&#39;s session ID, they&#39;ll be recognized as the victim to the server. Many developers assume that some network control like IP restrictions, user-agent fingerprinting, or something else will prevent an attacker from using a session ID stolen from the victim. There is almost never such a compensating control, and thus session IDs must be protected.\n\nAlthough the overexposure in the various log files is undesirable, it may not appear to be a serious issue. The bigger problem with session rewriting is that it allows an attack called Session Fixation. Session Fixation is an umbrella term for any attack that can allow an attacker to cause a victim to use a session ID that they know. If the victim then authenticates under the attacker&#39;s chosen session ID, they can present the same session ID to the server and be recognized as the victim.\n\nHere&#39;s a very simple scenario, taken from Wikipedia&#39;s Session Fixation page:\n\tMallory visits http://vulnerable.example.com/ and checks which SID is returned. For example, the server may respond: Set-Cookie: SID=0D6441FEA4496C2.\n\tMallory is now able to send Alice an e-mail: &quot;Check out this new cool feature on our bank, http://vulnerable.example.com/?SID=0D6441FEA4496C2.&quot;\n\tAlice logs on, with fixated session identifier SID=0D6441FEA4496C2.\n\nThe following request contained the session ID rewritten into the URL, which is how this issue was uncovered:\n\n## Recommendation\nUntil the Java Servlet Specification (JSS) 3.0, the disabling of URL rewriting were all container-specific. Our advice is arranged into two sections - recommendations for JSS 3.0 compatible applications, and recommendations for everyone else.\n\nDisabling URL Rewriting in Java Servlet Specification 3.0 Compatible Container\n\t1. You can disable session rewriting by adding this snippet to your web.xml:\n\t\t&lt;session-config&gt;\n\t\t\t&lt;tracking-mode&gt;COOKIE&lt;/tracking-mode&gt;\n\t\t&lt;/session-config&gt;\n\t2. You can also set this value programmatically:\n\t\tServletContext sc = request.getSession().getServletContext();\n\t\tsc.setSessionTrackingModes(EnumSet.of(SessionTrackingMode.COOKIE));\n\nDisabling URL Rewriting in non-JSS 3.0 Containers\n\t1. Use your container&#39;s specific method for preventing URL rewriting. Most major containers support this feature in one way or another. For example, here&#39;s how you do it in Tomcat 6:\n\t\t&lt;?xml version=&#39;1.0&#39; encoding=&#39;utf-8&#39;?&gt;\n\t\t&lt;Context docBase=&quot;/acme&quot; path=&quot;/AcmeWidgets&quot; disableURLRewriting=&quot;true&quot;&gt;\n\t\t\t...\n\t\t&lt;/Context&gt;\n\n\t2. Use your own HttpServletResponseWrapper subclass. Here&#39;s an example from the ESAPI project that prevents URLs from being rewritten by overriding encodeURL():\n\t\t/**\n\t\t* Return the URL without any changes, to prevent disclosure of the\n\t\t* Session ID. The default implementation of this method can add the\n\t\t* Session ID to the URL if support for cookies is not detected. This\n\t\t* exposes the Session ID credential in bookmarks, referer headers, server\n\t\t* logs, and more.\n\t\t*\n\t\t* @param url\n\t\t* @return original url\n\t\t*/\n\t\tpublic String encodeURL(String url) {\n\t\t    return url;\n\t\t}\n\n \t3. If using Spring, utilize the &quot;disable-url-rewriting&quot; attribute in your HTTP bean definition:\n\t\t&lt;security:http auto-config=&quot;false&quot; use-expressions=&quot;true&quot; disable-url-rewriting=&quot;true&quot;&gt;\n\t\n\tNOTE: It&#39;s also a good idea to rotate the user&#39;s session ID after they&#39;ve logged in. That way, if an attacker has compromised or seeded the session in any way, only the user who just proved they are who they say they are (via authentication) will have continued access. This won&#39;t affect the user. Rotating the session ID in Java EE applications is fairly easy:\n\t\trequest.getSession().invalidate();\n    \trequest.getSession(true);\n\n## First Event\n``````(no event)``````\n\n## Last Event\n``````(no event)``````\n\n## HTTP Request\nGET http://localhost:8080/resources/css/petclinic.css;jsessionid=F4694E88EE928C543F80D48ED688A769 HTTP/1.0\nReferer: http://localhost:8080/\nCookie: JSESSIONID=F4694E88EE928C543F80D48ED688A769\nAccept-Language: en-us\nHost: localhost:8080\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Safari/522.0\nConnection: keep-alive\nAccept-Encoding: gzip, deflate\nAccept: text/css,*/*;q=0.1\n\n\n\n"}}
{"actor":{"display_login":"planetlevel"}}