fuel/core — Issue #559: Session previous_id is a threat
Author: arbme
Created: 2011-10-10 06:52:08+00:00
State: open

I have been playing with the session db class and have come across some interesting findings.

I found that if I used rotate() (had to edit to make work for testing) to create a new session_id and encoded cookie. If I then use the previous encoded cookie data, the session class passes it, so gaining access through session hijacking is possible.

Most interestingly both previous_id and session_id are reset in the db to the previous_id, thus logging out the user who logged in first who happens to be the owner of the account. The fact that the hacker can simple reuse the hijacked session over and over and when rotate() is called after x amount of time, his cookie is refreshed and continue doing damage.

I no pro on security, hell im no pro at php but seem to me having previous_id like this is a security hole and I don't undertsand fully why it is there.

E.g.

1. Owner visits site logs in and gets cookie[1].
2. User gets cookie[1] hijacked and then rotate() is called after x amount of time, new session_id and cookie[2] are given to owner only.
3a. Hacker uses cookie[1], it passes and hacker has access to user's account.
3b. Session sets in db both session_id/previous_id to the id sent in cookie[1] which is the previous_id.
4. Owner navigates the site and is logged out due to his session id not being in the db anymore.
5. Hacker continues browsing the users account.
6. Owner logs in again.
7. Aslong as the hacker keeps using cookie[1] before the rotate() is called he will remain in control. Go to step 1.

Hope this helps and would love hear your opinions and to help furthur.

Great work so far guys!