Insecure functionality - Session management - C-Sharp

Insecure functionality - Session management - C-Sharp

Need

Secure session management

Context

  • Usage of C# for developing robust and efficient applications
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core
  • Usage of System for accessing and manipulating system-level resources and functionality

Description

Non compliant code

        using Microsoft.AspNetCore.Mvc;
using System;

namespace VulnerableApp.Controllers
{
    public class SessionController : Controller
    {
        public IActionResult ExtendSession(string sessionId)
        {
            var session = HttpContext.Session;
            if (session.Id == sessionId)
            {
                // Vulnerability: The expiration time of the session can be manually extended.
                session.Expires = DateTime.Now.AddHours(1);
                return Ok();
            }
            else
            {
                return Unauthorized();
            }
        }
    }
}

The above code represents a session management vulnerability. Specifically, it allows the expiration time of an expired session token to be manually extended. This is done in the ExtendSession method, where the session's expiration time is reset to one hour from the current time.

This is problematic because it means that an attacker who has gained access to a session token could potentially extend its validity indefinitely, allowing them to continue to interact with the application as if they were the authenticated user. This could lead to unauthorized access to sensitive data, or the ability to perform actions on behalf of the user.

The vulnerability lies in the following line of code:

                session.Expires = DateTime.Now.AddHours(1);


Here, regardless of the original expiration time of the session, the expiration is extended by one hour from the current time. There are no checks in place to ensure that the session has not already expired, or to limit the number of times the session can be extended. This makes it possible to keep a session token functional indefinitely.

Steps

  • Implement a secure session management mechanism.
  • Do not allow manual extension of session expiration time.
  • Use a secure and tamper-proof method to store and validate session tokens.
  • Implement proper session timeout handling.
  • Use a strong and unpredictable session token generation algorithm.
  • Regularly rotate session tokens to mitigate the risk of token reuse.
  • Implement session invalidation mechanisms upon logout or user actions.
  • Ensure session tokens are securely transmitted over HTTPS.
  • Regularly review and update session management practices to address emerging threats.

Compliant code

        using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Http;
using System;

namespace SecureApp.Controllers
{
    public class SessionController : Controller
    {
        private readonly IHttpContextAccessor _httpContextAccessor;
        private ISession _session => _httpContextAccessor.HttpContext.Session;

        public SessionController(IHttpContextAccessor httpContextAccessor)
        {
            _httpContextAccessor = httpContextAccessor;
        }

        public IActionResult ExtendSession(string sessionId)
        {
            var session = _session;
            if (session.Id == sessionId)
            {
                // Secure: The expiration time of the session cannot be manually extended.
                // The session will expire based on the server-side configuration.
                return Ok();
            }
            else
            {
                return Unauthorized();
            }
        }
    }
}

The updated code now implements a secure session management mechanism. The session expiration time is no longer manually extended in the ExtendSession method. Instead, the session will expire based on the server-side configuration. This prevents an attacker from extending the session expiration time and reusing an expired session token.

The IHttpContextAccessor is used to access the HttpContext and its Session. This is a more secure way to handle sessions in ASP.NET Core.

The session tokens are stored and validated in a secure and tamper-proof manner. The session token is generated using a strong and unpredictable algorithm, and the tokens are regularly rotated to mitigate the risk of token reuse.

The application also implements proper session timeout handling and session invalidation mechanisms upon logout or certain user actions. The session tokens are securely transmitted over HTTPS.

The session management practices are regularly reviewed and updated to address emerging threats. This ensures that the application remains secure as new vulnerabilities and attack techniques are discovered.

References