I usually see session fixation vulnerabilities with Java web applications. Just recently I found a ColdFusion application vulnerable to session fixation. This nasty security hole greatly increases the risk that legitimate sessions will be hijacked. Both HP WebInspect and Burp Pro's active scanner failed to find this vulnerability. Testing for session fixation is quite easy to do, so I ran a quick test for it manually, and I'm very glad I did.
When testing for session fixation, I like to use two different browsers: IE and Firefox. If the login page for an application is https://someapp.com/login, my test for session fixation consists of the following steps:
- 1. Launch Firefox and navigate directly to the login page.
2. Inspect the cookie(s) assigned by the application. For a Java web app, a JSESSIONID cookie is normally set. In the case of ColdFusion, CFID and CFTOKEN cookies are typically set.
3. Copy the session ID from the cookie.
4. Construct a special URL that contains the session ID.
For Java, it looks like this:
For CF, it looks like this:
5. Open IE and configure it to run through a proxy (Burp, Paros, Fiddler2, etc.).
6. Paste the special URL into the IE address bar and hit Enter (this step simulates a victim clicking on a link in an email or Internet post).
7. Observe the HTTP response from the server. Is there a "Set-Cookie" header? If so, what is the session ID being set? You have a problem if it's the same value that appears in the URL. On the other hand, you're probably okay if the value is different.
The URL of the request was:
The HTTP response contained the following headers:
Set-Cookie: CFID=999555; path=/; Secure
Set-Cookie: CFTOKEN=29292929; path=/; Secure