CAPEC-60: Reusing Session IDs (aka Session Replay)
Description
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
- Likelihood of attack
- High
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Subvert Access Control
Prerequisites
- The target host uses session IDs to keep track of the users.
- Session IDs are used to control access to resources.
- The session IDs used by the target host are not well protected from session theft.
Skills required
- LowIf an attacker can steal a valid session ID, they can then try to be authenticated with that stolen session ID.
- MediumMore sophisticated attack can be used to hijack a valid session from a user and spoof a legitimate user by reusing their valid session ID.
Consequences
- ConfidentialityAccess ControlAuthorization
Gain Privileges
Mitigations
- Always invalidate a session ID after the user logout.
- Setup a session time out for the session IDs.
- Protect the communication between the client and server. For instance it is best practice to use SSL to mitigate adversary in the middle attacks (CAPEC-94).
- Do not code send session ID with GET method, otherwise the session ID will be copied to the URL. In general avoid writing session IDs in the URLs. URLs can get logged in log files, which are vulnerable to an attacker.
- Encrypt the session data associated with the session ID.
- Use multifactor authentication.
Related weaknesses (CWE)
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor
- CWE-285Improper Authorization
- CWE-290Authentication Bypass by Spoofing
- CWE-294Authentication Bypass by Capture-replay
- CWE-346Origin Validation Error
- CWE-384Session Fixation
- CWE-488Exposure of Data Element to Wrong Session
- CWE-539Use of Persistent Cookies Containing Sensitive Information
- CWE-664Improper Control of a Resource Through its Lifetime
- CWE-732Incorrect Permission Assignment for Critical Resource
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-TBAToken-based Authentication2 shared
- D3-TBToken Binding2 shared
- D3-ANCIAuthentication Cache Invalidation2 shared
- D3-CCSACredential Compromise Scope Analysis2 shared
- D3-CHCredential Hardening2 shared
- D3-CRCredential Revocation2 shared
- D3-CROCredential Rotation2 shared
- D3-CTSCredential Transmission Scoping2 shared
- D3-DUCDecoy User Credential2 shared
- D3-MFAMulti-factor Authentication2 shared
- D3-RICReissue Credential2 shared
- D3-HBPIHardware-based Process Isolation2 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.