You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2006/08/09 15:39:52 UTC
DO NOT REPLY [Bug 40222] New: - Default Tomcat configuration alows easy session hijacking
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40222>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40222
Summary: Default Tomcat configuration alows easy session
hijacking
Product: Tomcat 5
Version: 5.0.15
Platform: All
OS/Version: All
Status: NEW
Severity: major
Priority: P2
Component: Catalina
AssignedTo: tomcat-dev@jakarta.apache.org
ReportedBy: thulek@cz.ibm.com
Tomcat should not carry over a session id generated under HTTP do HTTPS
requests. After authentication, the session ID becomes THE secret password.
In reality, many standard servlets (including e.g. Apache MyFaces servlet)
return a session ID on the first request. After switch to SSL (with
authentication), the session ID is retained, thus allowing easy session hijacking.
In the ideal world the session should survive the switch from HTTP to HTTPS, but
the session ID must change upon switch to HTTPS.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40222>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40222
------- Additional Comments From thulek@cz.ibm.com 2006-12-26 11:31 -------
(In reply to comment #1)
> Are you sure the same session is indeed carried over? I thought we'd
> implemented the opposite (new session when moving from HTTP to HTTPS), quite
> purposefully for security, as far back as Tomcat 3.x. See for example
Yes, I am sure. The problem can be demonstrated like this:
1) Using HTTP, go to an insecure page which assigns a JSESSIONID (eg. any JSF page)
2) Notice the JSESSIONID (which can be sniffed on the network by man-in-the-middle)
3) Go to an authenticated HTTPS page (eg. via form-based login). Look at the
"secure data".
The JSESSIONID is still the same!
4) From another computer, write the URL of the authenticated page including the
JSESSIOND obtained in step 2 above. Bingo - the hacker is in!
In order to circumvent the problem, we had to insert code into the login page
which invalidates previously assigned session, loosing all session info.
An easy fix in Tomcat would be to change (or append) the JSESSIONID upon
switching from HTTP to HTTPS. Switching from HTTPS to HTTP is already forbidden
as you mention, which is correct.
Tomas
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40222>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40222
markt@apache.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Severity|major |enhancement
------- Additional Comments From markt@apache.org 2007-01-20 18:09 -------
Marking this as an enhancement and awaiting a patch for review.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40222>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40222
darryl@darrylmiles.org changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |darryl@darrylmiles.org
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40222>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40222
------- Additional Comments From chris@sourcelabs.com 2007-01-11 10:46 -------
I was able to easily replicate this on 5.5.20.
RE #1 - unless I'm misreading the referenced post, that discussion is about new
sessions being created when going https-->http, not the other way around.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40222>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40222
------- Additional Comments From remm@apache.org 2007-01-12 04:33 -------
The session id as defined by the specification can be used by the user for a
variety of things, or can be pretty much set in stone due to other factors
(session clustering, persistent storage). So I'd suggest calming down and
relaxing, because this is not going to be fixed.
The proprietary solution (which could be enabled using a valve) is to expire the
session and create a new one with a different session id, and as a convenience,
Tomcat could copy over some of the session data. Feel free to submit such a
valve if you'd like to.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40222>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40222
------- Additional Comments From thulek@cz.ibm.com 2007-01-12 00:37 -------
NO, the problem is that the SessionID, when switching from HTTP to HTTPS remains
the same!!!
I believe this is a serious security issue and should be dealt with.
The attack scenario again:
1) A HTTP page assigns a SessionID
2) Man-in-the-Middle notices the SessionID
3) Upon switch to HTTPS, the SesssionID remains the same. After login to HTTPS
secure area the man-in-the-middle is able access all HTTPS pages just using the
SessionID obtained.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 40222] - Default Tomcat configuration alows easy session hijacking
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=40222>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=40222
yoavs@computer.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
------- Additional Comments From yoavs@computer.org 2006-12-26 06:45 -------
Are you sure the same session is indeed carried over? I thought we'd
implemented the opposite (new session when moving from HTTP to HTTPS), quite
purposefully for security, as far back as Tomcat 3.x. See for example
http://mail-archives.apache.org/mod_mbox/tomcat-users/200301.mbox/%3C3E1F642E.4610DE28@attbi.com%3E
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org