Weakness · High
CWE-384: Session Fixation
What it is
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
- Severity (our rating)
- High
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Architecture and Design, Implementation
- Exploited in the wild
- 1 known exploited CVE
In more detail
Such a scenario is commonly observed when: A web application authenticates a user without first invalidating the existing session, thereby continuing to use the session already associated with the user. An attacker is able to force a known session identifier on a user so that, once the user authenticates, the attacker has access to the authenticated session. The application or container uses predictable session identifiers. In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user's account through the active session.
What an attacker can do
- Gain Privileges or Assume Identity (Access Control)
How to prevent it
Architecture and Design
- Invalidate any existing session identifiers prior to authorizing a new user session.
- For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.
Operation
- Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth.
While the code is being fixed, a WAF in blocking mode stops session fixation attempts at the edge.
Exploited in the wild: 1 CVE
Vulnerabilities caused by CWE-384 that attackers have used, from CISA's Known Exploited Vulnerabilities catalog, newest first.
The Dome
Block it at the edge while you fix it
The Dome's WAF runs the OWASP Core Rule Set in blocking mode and stops session fixation attempts before they reach your application.
See the DomeT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.