Skip to main content

Insecure functionality - Session management

Need​

Secure session management

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance improvements
  • Usage of javax.servlet-api for Java Servlet development

Description​

Non compliant code​

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class SessionServlet extends HttpServlet {

    protected void doGet(HttpServletRequest request, HttpServletResponse response) {
        HttpSession session = request.getSession(false);
        if (session != null) {
            long lastAccessedTime = session.getLastAccessedTime();
            session.setMaxInactiveInterval((int) (System.currentTimeMillis() - lastAccessedTime));
        }
    }
}

This Java servlet is vulnerable to a session management security issue. The servlet retrieves an existing HTTP session associated with the current user request. If a session exists, it modifies the session's maximum inactive interval based on the current time and the last accessed time of the session.

The vulnerability lies in the fact that the maximum inactive interval of a session, which determines the session expiration time, is being set based on user input. This means that a malicious user can manipulate the expiration time of their session token, potentially making an expired session token functional again.

This is a significant security issue, because it allows an attacker to extend their session indefinitely, bypassing any server-side session timeout controls. This means that if an attacker manages to steal a user's session token, they can continue to use that session to impersonate the user and perform actions on their behalf, even after the session should have expired. This could allow the attacker to gain unauthorized access to sensitive information or functionality.

Steps​

  • Implement a secure session management mechanism.
  • Use a secure session token generation algorithm.
  • Set an appropriate expiration time for session tokens.
  • Do not allow modification of the expiration time of expired session tokens.
  • Invalidate and destroy expired session tokens.
  • Implement proper session timeout handling.
  • Use secure session storage to prevent unauthorized access or tampering.
  • Regularly review and update session management mechanisms to address new vulnerabilities.

Compliant code​

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class SessionServlet extends HttpServlet {

    private static final int SESSION_EXPIRATION_TIME = 30 * 60; // 30 minutes

    protected void doGet(HttpServletRequest request, HttpServletResponse response) {
        HttpSession session = request.getSession(false);
        if (session != null) {
            long lastAccessedTime = session.getLastAccessedTime();
            long currentTime = System.currentTimeMillis();
            long timeSinceLastAccess = currentTime - lastAccessedTime;

            if (timeSinceLastAccess > SESSION_EXPIRATION_TIME * 1000) {
                session.invalidate();
            } else {
                session.setMaxInactiveInterval(SESSION_EXPIRATION_TIME);
            }
        }
    }
}

The updated code includes a secure session management mechanism. The session token generation algorithm is handled by the Java Servlet API, which is secure and widely used.

The session expiration time is set to 30 minutes, which is a common practice for web applications. This value can be adjusted according to the specific needs of the application.

The code does not allow modification of the expiration time of expired session tokens. If a session token has expired (i.e., more than 30 minutes have passed since the last access), the session is invalidated and destroyed.

The session timeout handling is implemented in the doGet method. If the session is still active, the maximum inactive interval is updated to the session expiration time.

The session storage is handled by the Java Servlet API, which provides secure session storage mechanisms to prevent unauthorized access or tampering.

Finally, it is recommended to regularly review and update the session management mechanisms to address new vulnerabilities. This includes keeping the Java Servlet API and the Java Runtime Environment (JRE) up to date, as well as regularly reviewing the application code for potential security issues.

References​

Last updated on