vanillaforums/Garden — Issue #1163: Predictable Cookie Session IDs
Author: scog
Created: 2011-10-17 20:20:12+00:00
State: open

After being subject to a application-vulnerability scan, the following results came back:

The web application at http://domain/forum is using predictable cookie-based authentication session IDs. Ideally, session IDs are generated at random using characters/numbers that cannot be guessed by an attacker. If the session ID is predictable, an attacker could hijack an active user's session, allowing the attacker to interact with the server as though they were the victim. If the session ID is used to track the state of authentication, the session ID of an authenticated user could be guessed, bypassing any need for a username/password. The result of the application scan showed that the cookies are being consistently incremented.

I understand the likelihood of this happening is slim-to-none, and there may be a configuration option in Vanilla to change this but I have not been successful in location such an option.

Could someone give me some insight on this? Is this a false-positive on the application-vulnerability scan? We are using version 2.0.17.10.

Any information on this would be greatly appreciated. Thanks!