Session Fixation Attack

A Session Fixation Attack is a specific class of Application-Level Session Hijacking that allows attackers to hijack valid user sessions.

The attack exploits the vulnerability of a server that allows a user to use a fixed Session ID and relies on the attacker providing a valid session identifier before the legitimate user logs in and authenticates.

Core Mechanism and Goal

The primary objective of a session fixation attack is to bypass the authentication process by fixing an established session on the victim's browser.

1. Attacker Establishes Session: The attacker first obtains a legitimate session ID by establishing a connection with the target web server.
2. Fixation Phase: The attacker introduces this known session ID to the victim's browser, thereby fixing the session. The attacker may use a session ID generated by the web application for their own session, and then trick the victim into using it.
3. Luring the Victim (Entrance Phase): The attacker tricks or lures the victim into authenticating themselves using that Session ID. This is done by sending a link containing the established session ID.
4. Authentication: The victim clicks the link, believing it to be legitimate, and proceeds to log in. Since the session ID is already established and in an active state, the server checks the ID but often does not create a new session, but rather grants access to the existing, attacker-known session ID.
5. Hijacking: Once the user successfully logs in, the attacker now possesses the validated session ID and can gain complete access to the user's data and perform operations on behalf of the legitimate user. The victim is said to have logged into the attacker's session.

Background

Web session security prevents an attacker from ==intercepting, Brute forcing, or predicting the session ID ==issued by a web server to a user's browser as proof of an authenticated session

• However, this approach ignores the possibility of the attacker issuing a session ID to the user's browser, forcing it to use the chosen session ID
• This type of attack is called a session fixation attack because an attacker fixes the user's session ID in advance, instead of generating it randomly at the time of login
• The attacker performs a session fixation attack to hijack a valid user session
• The attacker takes advantage of limitations in web-application session ID management
• Web applications allow the user to authenticate themselves using an existing session ID, instead of generating a new session ID
• In this type of attack, the attacker provides a legitimate web-application session ID and lures the victim to use it
• If the victim's browser uses that session ID, then the attacker can hijack the user-validated session because the attacker is already aware of the session ID used by the victim
  • A session fixation attack is a kind of Session Hijacking
• However, instead of stealing the session established between a user and web server after the user logs in, a session fixation attack fixes an established session on the user's browser; thus, the attack is initiated before the user logs in

Techniques for Executing Session Fixation

The technique used to execute the session fixation attack depends on how the web application handles session tokens:

Session token in the URL argument

The Session ID is sent to the victim via a malicious hyperlink, and the victim accesses the site through this manipulated URL. If session IDs are exposed in the URL, the web application is vulnerable.

Session token in a hidden form field

The victim must be tricked into authenticating in the target web server using a login form developed by the attacker, which contains the fixed session token in a hidden field.

Session ID in a cookie

The attacker may use client-side scripting attacks like Cross-Site Scripting (XSS) to insert malicious code in the hyperlink sent to the victim, forcing a fixed Session ID into the victim's cookie.

Attack Phases

The attacker must choose a technique based on how the target web application uses session tokens. The attacker exploits the vulnerability of a server that allows a user to use a fixed session ID. Then, the attacker provides a valid session ID to a victim and lures him to authenticate themselves using that session ID. A session fixation attack has the following three phases.

• Session set-up phase: In this phase, the attacker first obtains a legitimate session ID by establishing a connection with the target web server. Few web servers support the idle session time-out feature. If the target web server supports this feature, the attacker needs to send requests repeatedly to keep the established trap session ID alive.

• Fixation phase: In this phase, the attacker introduces the session ID to the victim's browser, thereby fixing the session.

• Entrance phase: In this phase, the attacker waits for the victim to log in to the target web server using the trap session ID and then enters the victim's session.

sequenceDiagram
    participant Attacker
    participant WebServer
    participant Victim

    %% Session Set-Up Phase
    Note over Attacker, WebServer: **Session Set-Up Phase**
    Attacker->>WebServer: Request to get legitimate session ID
    WebServer->>Attacker: Returns session ID
    Attacker->>Attacker: Keep session alive (if idle session timeout is supported)
    
    %% Fixation Phase
    Note over Attacker, Victim: **Fixation Phase**
    Attacker->>Victim: Lure victim with the fixed session ID (in URL, hidden field, or cookie)
    
    %% Entrance Phase
    Note over Victim, WebServer: **Entrance Phase**
    Victim->>Victim: Victim loads the URL with session ID
    Victim->>WebServer: Login request with fixed session ID
    WebServer->>Victim: Authenticate user with fixed session ID
    Attacker->>Victim: Hijacks session using the fixed session ID

Countermeasures

Session fixation attacks are often linked to vulnerabilities in session management. Countermeasures include:

Regenerating Session IDs

The most effective countermeasure is to regenerate the session ID after a successful login. This prevents session fixation attacks by ensuring the Session ID used for authentication (which the attacker knows) is replaced with a new, random ID after the user successfully authenticates.

Cookie Security

Ensure proper session management and secure handling of cookies.

Vulnerability Scanning

Tools like Checkmarx One SAST can be used by security professionals to prevent various session hijacking attacks, including session fixation attacks.

Session Fixation is one of several techniques, alongside session token prediction, session replay, sidejacking, and XSS, that attackers use to capture valid session cookies and IDs in established sessions. The attack can also be used as a stepping stone within a larger attack scenario involving Unvalidated Redirects and Forwards.