I am copying the cookies from Browser A (admin user) and replacing them in Browser B (normal user) leads to the normal user session being converted to an admin session—is a security vulnerability related to session management.
Please find the attached images.
An attacker who can set or inject a valid session cookie into a victim's browser can impersonate that account, access sensitive data, and perform fully compromises user sessions (including admin account).
Could you kindly assist us in resolving the security vulnerability mentioned above?
8 Answer(s)
-
0
Hi @kansoftware
Thank you for your feedback. I've created an issue for this. You can follow the developments here. Thank you.
Markdown is supportedCopy & paste or drag & drop images (max 30 MB per image) -
0
Hi, when can we expect a solution for the above issues?
Markdown is supportedCopy & paste or drag & drop images (max 30 MB per image) -
0
Hi @kansoftware
This issue has been included in the 15.1 milestone. After the 15.0 version is released soon, it is planned to be resolved in version 15.1.
Markdown is supportedCopy & paste or drag & drop images (max 30 MB per image) -
0
We have upgraded to version 15.1, but I can still see the security vulnerability related to session management. I am able to copy the cookie from User A's session to User B's session and hijack User A's session.
Please let us know what changes you actually made, so we can confirm whether those changes are present in our upgrade.
Thanks for your help.
Markdown is supportedCopy & paste or drag & drop images (max 30 MB per image) -
0
Hi @kansoftware
This issue was originally planned for version 15.1, but it was resolved in the 15.2 milestone.
You can check the milestone here: https://github.com/aspnetzero/aspnet-zero-core/pull/5904.
Upgrading to the latest version, or 15.2 or higher, will likely resolve this issue.
Thank you
Markdown is supportedCopy & paste or drag & drop images (max 30 MB per image) -
0
As you mentioned that this issue was fixed in the 15.2 milestone, I downloaded a fresh copy of version 15.2 code.
However, I can still reproduce the security vulnerability related to session management. I am able to copy the session cookie from Admin User's session and use it in User B's session to hijack Admin User's session.
I have attached a video URL that clearly demonstrates the issue. admin-session-hijack It appears the fix is not working as expected — could you please look into this again?
Thanks for your help.
Markdown is supportedCopy & paste or drag & drop images (max 30 MB per image) -
0
Hi @kansoftware
Thank you very much for your feedback and detailed explanation. We will address this issue again and thoroughly check if it has been resolved.
If the problem persists, we will include a solution in version 15.5. I will keep you informed.
Thank you.
Markdown is supportedCopy & paste or drag & drop images (max 30 MB per image) -
0
Hi @kansoftware
In your current version, you can prevent this by enabling Session Management (Administration → Settings → Security → Session Management) with Validate Session Fingerprint turned on and the policy set to IP Address & User Agent. After you save the settings, please sign in again so that new sessions are created. With this configuration, a session cookie copied into a different browser or onto a different device is rejected, and the user is redirected to the login page.
However, when the cookie is copied between two windows of the same browser on the same device (for example, a normal window and an incognito window), the server cannot tell the two apart. Both send exactly the same IP address and browser information. This is a limitation of cookie-based authentication in general, not something specific to ASP.NET Zero. Anyone who can copy a cookie out of a browser on the user's own machine already has access to that user's session. The realistic attack, where a stolen cookie is used from another machine or network, is covered by the fingerprint validation.
We have also opened a PR that strengthens this area. It will be included in v15.5:
- Sessions are always validated. When Session Management is enabled, any cookie or token that is not bound to a tracked session is rejected. Every sign-in path (registration, password reset, tenant registration, etc.) now creates a tracked session.
- Copied cookies end the session. If a session is used from a different client, it is ended immediately, so neither the copy nor the original can keep using it.
- QR code login works with fingerprint validation. The session is now bound to the browser that displays the QR code, not to the mobile device that scans it.
- New idle timeout setting. Sessions can be ended automatically after a configurable period of inactivity.
Related Pull Request
Please let us know if you have any questions.
Thank you.
Markdown is supportedCopy & paste or drag & drop images (max 30 MB per image)
