Skip to main content

Insecure functionality - Session management

Need​

Secure session management

Context​

  • Usage of Scala for building scalable and high-performance applications
  • Usage of play.api.mvc for handling HTTP requests and responses in Play Framework

Description​

Non compliant code​

import play.api.mvc._

object Application extends Controller {
  def index = Action { request =>
    request.session.get("user").map { user =>
      Ok("Hello " + user)
    }.getOrElse {
      Unauthorized("Oops, you are not connected")
    }
  }

  def login = Action { request =>
    Ok("Welcome!").withSession(request.session + ("user" -> "admin"))
  }

  def logout = Action { request =>
    Ok("Bye").withNewSession
  }
}

The above code is a simple Play Framework application written in Scala, which has a session management vulnerability.

The index function checks if the session contains a "user" key. If it does, it greets the user; otherwise, it returns an Unauthorized error. The login function sets the "user" key in the session to "admin", effectively logging the user in. The logout function discards the current session and creates a new one, effectively logging the user out.

The vulnerability lies in the fact that the session token's expiration time is not being checked or managed properly. The application does not validate if the session token has expired when receiving a request. It only checks if the "user" key exists in the session. This means that if an attacker can modify the expiration time of an expired session token, they can make the token functional again and continue to query the application as if they were the user to whom the session token was originally issued.

This vulnerability could allow an attacker to hijack a user's session and perform actions on their behalf, potentially leading to unauthorized access to sensitive information or functionality.

Steps​

  • Implement a secure session management mechanism.
  • Use a secure session token generation algorithm.
  • Set an appropriate expiration time for session tokens.
  • Implement session token validation to ensure tokens are not modified or tampered with.
  • Invalidate session tokens after logout or when the session expires.
  • Use secure transport protocols (e.g., HTTPS) to protect session data during transmission.
  • Regularly review and update session management mechanisms to address any new vulnerabilities or best practices.

Compliant code​

import play.api.mvc._
import play.api.libs.Crypto

object Application extends Controller {
  def index = Action { request =>
    request.session.get("user").map { user =>
      Ok("Hello " + user)
    }.getOrElse {
      Unauthorized("Oops, you are not connected")
    }
  }

  def login = Action { request =>
    val encryptedSession = Crypto.encryptAES("user" -> "admin")
    Ok("Welcome!").withSession(request.session + ("user" -> encryptedSession))
  }

  def logout = Action { request =>
    Ok("Bye").withNewSession
  }
}

The updated code now includes a secure session management mechanism. The session token is encrypted using the Play Framework's Crypto library, which provides a secure way to encrypt and decrypt data.

In the login function, the session token is encrypted before being added to the session. This ensures that even if the session token is intercepted, it cannot be read or modified without the encryption key.

The logout function invalidates the session token by creating a new session. This ensures that the old session token cannot be used again after logout.

This code also assumes that the application is using a secure transport protocol (e.g., HTTPS) to protect session data during transmission.

Remember to regularly review and update session management mechanisms to address any new vulnerabilities or best practices.

References​

Last updated on