[jira] Issue Comment Edited: (AXIS2-4739) Apache Axis2 Session Fixation

["Tiago Ferreira Barbosa (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/AXIS2-4739?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12878728#action_12878728 ] 

Tiago Ferreira Barbosa edited comment on AXIS2-4739 at 6/14/10 4:21 PM:
------------------------------------------------------------------------

Not necessarily, consider the case in which an attacker sends a malicious URL (see code snippet) for the administrator, and when he access the admin page via this URL, your session can be stolen.



      was (Author: tiagoferreira):
    Not necessarily, consider the case in which an attacker sends a malicious URL (see code snippet) for the administrator, and when he access the admin page via this URL, your session might have stolen.


  
> Apache Axis2 Session Fixation
> -----------------------------
>
>                 Key: AXIS2-4739
>                 URL: https://issues.apache.org/jira/browse/AXIS2-4739
>             Project: Axis2
>          Issue Type: Bug
>    Affects Versions: 1.5.1, 1.5, 1.4.1
>         Environment: Tested on Linux Ubuntu & Debian. Other distributions may be vulnerable.
>            Reporter: Tiago Ferreira Barbosa
>            Priority: Critical
>
> We have found a Session Fixation Vulnerability in administrative interface of Apache Axis2. When successfully exploited, this vulnerability allows to fixate a session Cookie in the browser of the victim, this way it's possible to perform session hijacking attacks.
> The vulnerability was found in the administrative interface of Axis2. By default, it is accessible at the path /axis2/axis2-admin. To exploit this flaw, we used a Cross Site Script in existing Axis2 (http://www.exploit-db.com/exploits/12721/).
> Code Snippet:
> http://example:8080/axis2/axis2-admin/engagingglobally?submit=%2bEngage 2b&modules=<script>document.cookie="JSESSIONID=C958373831119190D2DC7838BA177980.tomcat1; 
> Path=/axis2";document.location="http://example:8080/axis2/axis2-admin/"</script>
> The above code when run on the victim's browser, fixates the session cookie sent by the attacker to it.
> To protect against session fixation, the HTTP session must be invalidated and recreated on login, giving the user a new session id. 

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.


---------------------------------------------------------------------
To unsubscribe, e-mail: java-dev-unsubscribe@axis.apache.org
For additional commands, e-mail: java-dev-help@axis.apache.org