Security: Session Identifier Not Updated in tcl

Question

I'm working on open-source application "Project-Open" and during the scanning I got the following vulnerability:

[Medium] Session Identifier Not Updated
Issue: 13800882
Severity: Medium
URL: https://<server_name>/register/
Risk(s): It is possible to steal or manipulate customer session and cookies, which might be used to impersonate a legitimate user,allowing the hacker to view or alter user records, and to perform transactions as that user
Fix: Do not accept externally created session identifiers

though the fix is mentioned but it is not sufficient for me to understand it completely.please guide me how should I remove this.Also let me know if any further details are needed to understand the question. The project source code is in tcl

I found the following code which does the same but it's in java.

  public HttpSession changeSessionIdentifier(HttpServletRequest request) throws AuthenticationException {

     // get the current session
        HttpSession oldSession = request.getSession();

     // make a copy of the session content
        Map<String,Object> temp = new ConcurrentHashMap<String,Object>();
        Enumeration e = oldSession.getAttributeNames();
        while (e != null && e.hasMoreElements()) {
               String name = (String) e.nextElement();
               Object value = oldSession.getAttribute(name);
               temp.put(name, value);
        }

     // kill the old session and create a new one
        oldSession.invalidate();
        HttpSession newSession = request.getSession();
        User user = ESAPI.authenticator().getCurrentUser();
        user.addSession( newSession );
        user.removeSession( oldSession );

     // copy back the session content
        for (Map.Entry<String, Object> stringObjectEntry : temp.entrySet()){
             newSession.setAttribute(stringObjectEntry.getKey(),       stringObjectEntry.getValue());
         }
  return newSession;

}

P.S. I'm newbie in TCL. please let me know if you need any further explanation.

Answer 1

There is a fix in OpenACS 5.9 that addresses your scanning reports. Please see the following discussion on OpenACS.org for reference.

http://www.openacs.org/forums/message-view?message_id=5332821

Answer 2

The problem that the OWASP report is talking about is the inability to migrate a session to use a new ID, making it easier for an attacker to discover the ID and reuse it. The protection against this is to change the session ID from time to time (no, I don't know how often!) and that Java code is involved in doing just that.

A session is represented as a token stored in the browser, usually in a cookie (and this is what cookies are designed to do). That token is then used to look up the database record corresponding to the session, which holds serializations of the key/value mappings in the session. It's a simple mechanism, but very powerful. The Java code for doing all this will be fairly complex behind the scenes because of the serialization, etc., but Tcl values are (usually, and always for built-in types) naturally serializable and so should prove much less of a problem in this; copying a session to a new key could be done without having to deserialize in the first place.

The exact code for doing this depends on the framework in use. I don't know what ]project-open[ uses, so that's as far as we can drill right now. You need to talk to other people actually working on PO…

---

For all that, the best way would be to make the key given to clients not be the primary key, so that you can change the session key without having to delete things. Just have a session key column (with an index!) and you'll be able to make things work fine. This is a more sophisticated approach though; it might not be practical to implement in your environment..