938
Potential Mitigations
Phase: Architecture and Design
Invalidate any existing session identifiers prior to authorizing a new user session.
Phase: Architecture and Design
For platforms such as ASP that do not generate new values for sessionid cookies, utilize a
secondary cookie. In this approach, set a secondary cookie on the user's browser to a random
value and set a session variable to the same value. If the session variable and the cookie value
ever don't match, invalidate the session, and force the user to log on again.
Demonstrative Examples
Example 1:
The following example shows a snippet of code from a J2EE web application where the application
authenticates users with LoginContext.login() without first calling HttpSession.invalidate().
Example Language: Java (Bad)
private void auth(LoginContext lc, HttpSession session) throws LoginException {
...
lc.login();
...
}
In order to exploit the code above, an attacker could first create a session (perhaps by logging into
the application) from a public terminal, record the session identifier assigned by the application, and
reset the browser to the login page. Next, a victim sits down at the same public terminal, notices
the browser open to the login page of the site, and enters credentials to authenticate against the
application. The code responsible for authenticating the victim continues to use the pre-existing
session identifier, now the attacker simply uses the session identifier recorded earlier to access the
victim's active session, providing nearly unrestricted access to the victim's account for the lifetime
of the session. Even given a vulnerable application, the success of the specific attack described
here is dependent on several factors working in the favor of the attacker: access to an unmonitored
public terminal, the ability to keep the compromised session active and a victim interested in
logging into the vulnerable application on the public terminal.
In most circumstances, the first two challenges are surmountable given a sufficient investment
of time. Finding a victim who is both using a public terminal and interested in logging into the
vulnerable application is possible as well, so long as the site is reasonably popular. The less well
known the site is, the lower the odds of an interested victim using the public terminal and the lower
the chance of success for the attack vector described above. The biggest challenge an attacker
faces in exploiting session fixation vulnerabilities is inducing victims to authenticate against the
vulnerable application using a session identifier known to the attacker.
In the example above, the attacker did this through a direct method that is not subtle and does
not scale suitably for attacks involving less well-known web sites. However, do not be lulled into
complacency; attackers have many tools in their belts that help bypass the limitations of this attack
vector. The most common technique employed by attackers involves taking advantage of crosssite
scripting or HTTP response splitting vulnerabilities in the target site [12]. By tricking the victim
into submitting a malicious request to a vulnerable application that reflects JavaScript or other
code back to the victim's browser, an attacker can create a cookie that will cause the victim to
reuse a session identifier controlled by the attacker. It is worth noting that cookies are often tied
to the top level domain associated with a given URL. If multiple applications reside on the same
top level domain, such as bank.example.com and recipes.example.com, a vulnerability in one
application can allow an attacker to set a cookie with a fixed session identifier that will be used in all
interactions with any application on the domain example.com [29].
Example 2:
CWE Version 4.14
CWE-384: Session Fixation
CWE-384: Session Fixation