Session Fixation

Authenticating a user without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions

Session fixation vulnerabilities occur when:

1. A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user.
2. An attacker can force a known session identifier on a user so that, after the user authenticates, the attacker has access to the authenticated session.

In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to authenticate against the server using that session identifier, giving the attacker access to the user's account through the active session.

Some frameworks such as Spring Security automatically invalidates existing sessions when creating a new one. This behaviour can be disabled leaving the application vulnerable to this attack.

Example 1: The following example shows a snippet of a Spring Security protected application where session fixation protection has been disabled.

	<http auto-config="true">
        ...
        <session-management session-fixation-protection="none"/>
	</http>

Even given a vulnerable application, the success of the specific attack described here depends on several factors working in the attacker's favor: access to an unmonitored public terminal, the ability to keep the compromised session active, and a victim interested in logging into the vulnerable application on the public terminal. In most circumstances, the first two challenges are surmountable given a sufficient investment of time. Finding a victim who is both using a public terminal and interested in logging into the vulnerable application is possible as well, as long as the site is reasonably popular. The less popular the site, the lower the odds of an interested victim using the public terminal and the less chance of success for the attack vector previously described.

The biggest challenge an attacker faces in exploiting session fixation vulnerabilities is inducing victims to authenticate against the vulnerable application using a session identifier known to the attacker. In Example 1, the attacker does this through an obvious direct method that does not suitably scale for attacks involving less well-known web sites. However, do not be lulled into complacency; attackers have many tools in their belts that help bypass the limitations of this attack vector. The most common technique attackers use involves taking advantage of cross-site scripting or HTTP response splitting vulnerabilities in the target site [1]. By tricking the victim into submitting a malicious request to a vulnerable application that reflects JavaScript or other code back to the victim's browser, an attacker can create a cookie that causes the victim to reuse a session identifier controlled by the attacker.

It is worth noting that cookies are often tied to the top level domain associated with a given URL. If multiple applications reside on the same top level domain, such as bank.example.com and recipes.example.com, a vulnerability in one application can enable an attacker to set a cookie with a fixed session identifier that is used in all interactions with any application on the domain example.com [2].

Other attack vectors include DNS poisoning and related network-based attacks where an attacker causes the user to visit a malicious site by redirecting a request for a valid site. Network-based attacks typically involve a physical presence on the victim's network or control of a compromised machine on the network, which makes them harder to exploit remotely, but their significance should not be overlooked. Less secure session management mechanisms, such as the default implementation in Apache Tomcat, allow session identifiers normally expected in a cookie to be specified on the URL as well. This enables an attacker to cause a victim to use a fixed session identifier simply by emailing a malicious URL.