Bug 1825714 (CVE-2020-10714) - CVE-2020-10714 wildfly-elytron: session fixation when using FORM authentication
Summary: CVE-2020-10714 wildfly-elytron: session fixation when using FORM authentication
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-10714
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1827509 1827511 (view as bug list)
Depends On:
Blocks: 1818017 1827511
TreeView+ depends on / blocked
 
Reported: 2020-04-20 02:36 UTC by Ted Jongseok Won
Modified: 2021-10-28 09:48 UTC (History)
62 users (show)

Fixed In Version: wildfly-elytron 1.10.7.Final
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2020-08-17 15:15:54 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:3461 0 None None None 2020-08-17 13:28:45 UTC
Red Hat Product Errata RHSA-2020:3462 0 None None None 2020-08-17 13:30:56 UTC
Red Hat Product Errata RHSA-2020:3463 0 None None None 2020-08-17 13:34:28 UTC
Red Hat Product Errata RHSA-2020:3464 0 None None None 2020-08-17 13:26:25 UTC
Red Hat Product Errata RHSA-2020:3501 0 None None None 2020-08-18 16:35:34 UTC
Red Hat Product Errata RHSA-2020:3539 0 None None None 2020-09-02 09:47:50 UTC
Red Hat Product Errata RHSA-2020:3585 0 None None None 2020-08-31 15:41:17 UTC
Red Hat Product Errata RHSA-2020:3637 0 None None None 2020-09-07 12:56:52 UTC
Red Hat Product Errata RHSA-2020:3638 0 None None None 2020-09-07 13:03:00 UTC
Red Hat Product Errata RHSA-2020:3639 0 None None None 2020-09-07 12:59:45 UTC
Red Hat Product Errata RHSA-2020:3642 0 None None None 2020-09-07 13:08:03 UTC
Red Hat Product Errata RHSA-2020:3779 0 None None None 2020-09-17 13:09:55 UTC
Red Hat Product Errata RHSA-2020:4960 0 None None None 2020-11-05 18:47:36 UTC
Red Hat Product Errata RHSA-2020:4961 0 None None None 2020-11-05 18:49:02 UTC
Red Hat Product Errata RHSA-2021:3140 0 None None None 2021-08-11 18:23:07 UTC

Description Ted Jongseok Won 2020-04-20 02:36:18 UTC
WildFly Elytron FORM authentication when a session ID is present in the URL allows an attacker can perform a session fixation attack. There is a related bug ELY-1950 [1] on WildFly Elytron. Practically the bug ELY-1950 prevents this exploit being viable for FORM authentication but, this flaw is treated as a security vulnerability.

Note that, the other authentication mechanism which makes use of a session for persisting the current identity is the SPNEGO authentication mechanism where this attack could be executed in its current form. SPNEGO tends to be used on internal networks rather than the internet so this could be a mitigating factor that any attack would be from within. However, on the opposite perspective other than tricking the user into clicking the link the SPNEGO authentication could then occur silently with the victim not being as aware they have established an authenticated session.

[1] https://issues.redhat.com/browse/ELY-1950 FORM authentication not working for URL encoded session IDs

Comment 2 Ted Jongseok Won 2020-04-20 06:02:51 UTC
Mitigation:

This attack is dependent on the attacker being able to create a session and the victim accessing the session before the session expires, we do have a 15 minute session timeout by default but the attacker could also keep this alive by say sending in a request every five minutes.

The server by default supports session tracking by URL AND Cookie, if the web.xml is updated to support COOKIE only the exploit is not possible by sharing the link.
~~~
  <session-config>
    <tracking-mode>URL</tracking-mode>
  </session-config>
~~~
TO
~~~
  <session-config>
    <tracking-mode>COOKIE</tracking-mode>
  </session-config>
~~~

Comment 3 Ted Jongseok Won 2020-04-20 07:13:30 UTC
The session fixation attack is a class of Session Hijacking, which steals the established session between the client and the Web Server after the user logs in. Instead, the Session Fixation attack fixes an established session on the victim’s browser, so the attack starts before the user logs in. You can refer to more details in [1].
[1] https://owasp.org/www-community/attacks/Session_fixation

Comment 10 Pedro Sampaio 2020-04-24 13:56:39 UTC
*** Bug 1827511 has been marked as a duplicate of this bug. ***

Comment 11 Ted Jongseok Won 2020-04-27 01:24:05 UTC
*** Bug 1827509 has been marked as a duplicate of this bug. ***

Comment 12 Ted Jongseok Won 2020-04-30 11:04:57 UTC
Acknowledgments:

Name: Mark Banierink (Nedap)

Comment 13 errata-xmlrpc 2020-08-17 13:26:21 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:3464 https://access.redhat.com/errata/RHSA-2020:3464

Comment 14 errata-xmlrpc 2020-08-17 13:28:40 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 6

Via RHSA-2020:3461 https://access.redhat.com/errata/RHSA-2020:3461

Comment 15 errata-xmlrpc 2020-08-17 13:30:51 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 7

Via RHSA-2020:3462 https://access.redhat.com/errata/RHSA-2020:3462

Comment 16 errata-xmlrpc 2020-08-17 13:34:24 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.3 for RHEL 8

Via RHSA-2020:3463 https://access.redhat.com/errata/RHSA-2020:3463

Comment 17 Product Security DevOps Team 2020-08-17 15:15:54 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10714

Comment 18 errata-xmlrpc 2020-08-18 16:35:31 UTC
This issue has been addressed in the following products:

  Red Hat Single Sign-On 7.4.2

Via RHSA-2020:3501 https://access.redhat.com/errata/RHSA-2020:3501

Comment 19 errata-xmlrpc 2020-08-31 15:41:13 UTC
This issue has been addressed in the following products:

  EAP-CD 20 Tech Preview

Via RHSA-2020:3585 https://access.redhat.com/errata/RHSA-2020:3585

Comment 20 errata-xmlrpc 2020-09-02 09:47:45 UTC
This issue has been addressed in the following products:

  Red Hat Openshift Application Runtimes

Via RHSA-2020:3539 https://access.redhat.com/errata/RHSA-2020:3539

Comment 22 errata-xmlrpc 2020-09-07 12:56:48 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 6

Via RHSA-2020:3637 https://access.redhat.com/errata/RHSA-2020:3637

Comment 23 errata-xmlrpc 2020-09-07 12:59:42 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 8

Via RHSA-2020:3639 https://access.redhat.com/errata/RHSA-2020:3639

Comment 24 errata-xmlrpc 2020-09-07 13:02:55 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.2 for RHEL 7

Via RHSA-2020:3638 https://access.redhat.com/errata/RHSA-2020:3638

Comment 25 errata-xmlrpc 2020-09-07 13:07:59 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2020:3642 https://access.redhat.com/errata/RHSA-2020:3642

Comment 26 errata-xmlrpc 2020-09-17 13:09:49 UTC
This issue has been addressed in the following products:

  Red Hat Data Grid 7.3.7

Via RHSA-2020:3779 https://access.redhat.com/errata/RHSA-2020:3779

Comment 27 errata-xmlrpc 2020-11-05 18:47:33 UTC
This issue has been addressed in the following products:

  RHDM 7.9.0

Via RHSA-2020:4960 https://access.redhat.com/errata/RHSA-2020:4960

Comment 28 errata-xmlrpc 2020-11-05 18:48:59 UTC
This issue has been addressed in the following products:

  RHPAM 7.9.0

Via RHSA-2020:4961 https://access.redhat.com/errata/RHSA-2020:4961

Comment 30 errata-xmlrpc 2021-08-11 18:23:03 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.9

Via RHSA-2021:3140 https://access.redhat.com/errata/RHSA-2021:3140


Note You need to log in before you can comment on or make changes to this bug.