1372
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to
reuse old session credentials or session IDs for authorization."
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 672 Operation on a Resource after Expiration or Release 1479
CanPrecede 287 Improper Authentication 692
Relevant to the view "Weaknesses for Simplified Mapping of Published
Vulnerabilities" (CWE-1003)
Nature Type ID Name Page
ChildOf 672 Operation on a Resource after Expiration or Release 1479
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1018 Manage User Sessions 2432
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1217 User Session Errors 2479
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Set sessions/credentials expiration date.
Demonstrative Examples
Example 1:
The following snippet was taken from a J2EE web.xml deployment descriptor in which the sessiontimeout
parameter is explicitly defined (the default value depends on the container). In this case the
value is set to -1, which means that a session will never expire.
Example Language: Java (Bad)
<web-app>
[...snipped...]
CWE Version 4.14
CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute