CWE-384Session Fixation

Description

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

[object Object]

Common consequences

• Access Control→Gain Privileges or Assume Identity

Potential mitigations

• Architecture and Design
  Invalidate any existing session identifiers prior to authorizing a new user session.
• Architecture and Design
  For platforms such as ASP that do not generate new values for sessionid cookies, utilize a secondary cookie. In this approach, set a secondary cookie on the user's browser to a random value and set a session variable to the same value. If the session variable and the cookie value ever don't match, invalidate the session, and force the user to log on again.
• Operation
  Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].

Related CWEs

Recent CVEs classified under this CWE