Re: [Full-disclosure] Session data pollution vulnerabilities in web applications

[Frank Knobbe <frank () knobbe us>]

On Thu, 2006-01-12 at 11:33 +0000, Alla Bezroutchko wrote:
> As for fixing those bugs, I suppose one approach is having a separate
> session variable for each function in the application. For example new
> user registration will keep its stuff in $_SESSION["register"]["login"]
> and authentication will keep its stuff in $_SESSION["auth"]["login"]

These type of bugs stem from bad program design. (BTW: I wouldn't call
it session data pollution... your not polluting anything).

The proposed fix is -- besides being only specific to this example --
equally flawed. The underlying issue is that you trust user supplied
data. When a user supplies a user name for login purposes, you should
only use that input to perform a search in your database. If a match has
been found, take a *trusted* value from your database, for example an
index ID, and carry that in the session object to identify the user.

In other words, don't accept any user input (even after proper input
validation) and carry it as trusted data in your session object. Don't
base further decisions on this data. Since it is user supplied it can
not be trusted.

Your example is further flawed in that it allows the change of a
password without being properly authenticated. Just having a valid
'login' session object present doesn't indicate that the user is
authenticated. I really, really hope this was just an example you made
up, and not something you actually saw being used. If so, go back to
that web site with a clue-by-four and give it a few whacks.

But you are right that these type of issues are common. While we're
educating developers on secure program design, I think we need to do a
better job at teaching some paranoia too. Every programmer should have a
healthy dose of paranoia and distrust when writing applications :)

Cheers,
Frank


-- 
It is said that the Internet is a public utility. As such, it is best
compared to a sewer. A big, fat pipe with a bunch of crap sloshing
against your ports.

Attachment: signature.asc
Description: This is a digitally signed message part