Session fixation attacks take advantage of the way web applications manage session identifiers. Here’s how a session fixation attack typically
works:
- When a user visits a website or logs in, a session is created for them.
- This session is assigned a unique session identifier, stored in a cookie, in local storage, or through URL parameters.
- In a session fixation attack, an attacker tricks a user into using a predetermined session identifier controlled by the attacker. For example,
the attacker sends the victim an email containing a link with this predetermined session identifier.
- When the victim clicks on the link, the web application does not create a new session identifier but uses this identifier known to the
attacker.
- At this point, the attacker can hijack and impersonate the victim’s session.
What is the potential impact?
Session fixation attacks pose a significant security risk to web applications and their users. By exploiting this vulnerability, attackers can gain
unauthorized access to user sessions, potentially leading to various malicious activities. Some of the most relevant scenarios are the following:
Impersonation
Once an attacker successfully fixes a session identifier, they can impersonate the victim and gain access to their account without providing valid
credentials. This can result in unauthorized actions, such as modifying personal information, making unauthorized transactions, or even performing
malicious activities on behalf of the victim. An attacker can also manipulate the victim into performing actions they wouldn’t normally do, such as
revealing sensitive information or conducting financial transactions on the attacker’s behalf.
Data Breach
If an attacker gains access to a user’s session, they may also gain access to sensitive data associated with that session. This can include
personal information, financial details, or any other confidential data that the user has access to within the application. The compromised data can
be used for identity theft, financial fraud, or other malicious purposes.
Privilege Escalation
In some cases, session fixation attacks can be used to escalate privileges within a web application. By fixing a session identifier with higher
privileges, an attacker can bypass access controls and gain administrative or privileged access to the application. This can lead to unauthorized
modifications, data manipulation, or even complete compromise of the application and its underlying systems.
How to fix it in Symfony
Code examples
In a Symfony Security’s context, session fixation protection can be disabled with the value none for the
session_fixation_strategy attribute.
Session fixation protection is enabled by default in Symfony. It can be explicitly enabled with the values migrate and
invalidate for the session_fixation_strategy attribute.
Noncompliant code example
namespace Symfony\Component\DependencyInjection\Loader\Configurator;
return static function (ContainerConfigurator $container) {
$container->extension('security', [
'session_fixation_strategy' => 'none', // Noncompliant
]);
};
Compliant solution
namespace Symfony\Component\DependencyInjection\Loader\Configurator;
return static function (ContainerConfigurator $container) {
$container->extension('security', [
'session_fixation_strategy' => 'migrate',
]);
};
How does this work?
The protection works by ensuring that the session identifier, which is used to identify and track a user’s session, is changed or regenerated
during the authentication process.
Here’s how session fixation protection typically works:
- When a user visits a website or logs in, a session is created for them. This session is assigned a unique session identifier, which is stored
in a cookie or passed through URL parameters.
- In a session fixation attack, an attacker tricks a user into using a predetermined session identifier controlled by the attacker. This allows
the attacker to potentially gain unauthorized access to the user’s session.
- To protect against session fixation attacks, session fixation protection mechanisms come into play during the authentication process. When a
user successfully authenticates, this mechanism generates a new session identifier for the user’s session.
- The old session identifier, which may have been manipulated by the attacker, is invalidated and no longer associated with the user’s session.
This ensures that any attempts by the attacker to use the fixed session identifier are rendered ineffective.
- The user is then assigned the new session identifier, which is used for subsequent requests and session tracking. This new session identifier
is typically stored in a new session cookie or passed through URL parameters.
By regenerating the session identifier upon authentication, session fixation protection helps ensure that the user’s session is tied to a new,
secure identifier that the attacker cannot predict or control. This mitigates the risk of an attacker gaining unauthorized access to the user’s
session and helps maintain the integrity and security of the application’s session management process.
