onebyone CMS 远程会话固定漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1191081 漏洞类型 授权问题
发布时间 2007-04-10 更新时间 2007-04-10
CVE编号 CVE-2007-1952 CNNVD-ID CNNVD-200704-127
漏洞平台 N/A CVSS评分 7.5
|漏洞来源
https://www.securityfocus.com/bid/86365
https://cxsecurity.com/issue/WLB-2007040053
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200704-127
|漏洞详情
onelookonebyoneCMS中存在会话固定漏洞。远程攻击者可以通过设置PHPSESSIDcookie,劫持web会话。
|漏洞EXP
[MajorSecurity Advisory #39]onelook onebyone CMS - Session fixation Issue

Details
=======
Product: onebyone CMS
Remote-Exploit: yes
Vendor-URL: http://www.onebyone.ch/
Vendor-Status: informed
Advisory-Status: published

Credits
============
Discovered by: David Vieira-Kurz
http://www.majorsecurity.de

Original Advisory:
============
http://www.majorsecurity.de/index_2.php?major_rls=major_rls39

Introduction
============
onebyone CMS is a Content Management System.

More Details
============
1. Session fixation:
The Cookie variable "PHPSESSID" can be set to a malicious and arbitrary value.

1.1 Classification:
Session Fixation is an attack technique that forces a user's session ID to an explicit value.
Depending on the functionality of the target web site, a number of techniques can be utilized to "fix" the session ID value.
These techniques range from Cross-site Scripting exploits to peppering the web site with previously made HTTP requests.
After a user's session ID has been fixed, the attacker will wait for them to login.
Once the user does so, the attacker uses the predefined session ID value to assume their online identity.

Workaround: 
============
1. Do not accept session identifiers from GET / POST variables:
Session identifiers in URL (query string, GET variables) or POST variables are not recommended as it simplifies this attack - it is easy to make links or forms which sets GET / POST variables.

2.Regenerate SID on each request:
A powerful countermeassure against session fixation is to "regenerate" session identifier (SID) on each request.
This means that although attacker may trick a user into accepting a known SID, the SID will be invalid when attacker attempts to re-use the SID.

3. Accept only server generated SID:
One way to improve security is to not accept session identifiers not generated by server.

if ( ! isset( $_SESSION['SERVER_GENERATED_SID'] ) ) {
session_destroy(); // destroy all data in session
}
session_regenerate_id(); // generate a new session identifier
$_SESSION['SERVER_GENERATED_SID'] = true;

References:
-------------------------------------------------
http://www.acrossecurity.com/papers/session_fixation.pdf
http://www.webappsec.org/projects/threat/classes/session_fixation.shtml

History/Timeline
================
29.03.2007 discovery of the vulnerability
30.03.2007 additional tests with other versions
02.04.2007 contacted the vendor
05.04.2007 advisory is written
06.04.2007 advisory released

MajorSecurity
=======
MajorSecurity is a German penetration testing and security research project
which consists of only one person at the present time.
Currently looking for a site sponsor.
http://www.majorsecurity.de/
|受影响的产品
Onelook Onebyone Cms 0
|参考资料

来源:XF
名称:onebyonecms-phpsessid-security-bypass(33497)
链接:http://xforce.iss.net/xforce/xfdb/33497
来源:BUGTRAQ
名称:20070406[MajorSecurityAdvisory#39]onelookonebyoneCMS-SessionfixationIssue
链接:http://www.securityfocus.com/archive/1/archive/1/464884/100/0/threaded
来源:MISC
链接:http://www.majorsecurity.de/index_2.php?major_rls=major_rls39
来源:SREASON
名称:2546
链接:http://securityreason.com/securityalert/2546