Detections
Analytics

Session Fixation Attack on HTTP Cookies

high Nessus Plugin ID 45084

Language:

Synopsis

The remote web application is vulnerable to a session fixation attack.

Description

By manipulating cookies through a vulnerability similar to cross-site scripting, an attacker can set the session cookies. The legitimate user will be logged out of the application and after he logs in again, the cookie will remain unchanged and the attacker will be able to steal the open session and impersonate the user.

Solution

- Fix the application so that the session cookie is re-generated after a successful authentication.

- Fix the cookie manipulation flaws.

See Also

https://en.wikipedia.org/wiki/Session_fixation

https://www.owasp.org/index.php/Session_Fixation

Plugin Details

Severity: High

ID: 45084

File Name: http_session_fixation.nasl

Version: 1.16

Type: remote

Family: Web Servers

Published: 3/17/2010

Updated: 11/15/2018

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Reference Information

CWE: 287, 384, 718, 724, 812, 928, 930, 935