Hans Wolters wrote:
Matt,
On 16-mrt-2006, at 15:55, matt@xxxxxxxxxxxxxxxxx wrote:
This report is ridiculous and quite frankly shows that the author
does not understand how IPB works.
Yes, the author is correct in finding that if you: copy the user's IP
address, copy the user's user-agent and copy the user's session ID
then they can "hijack" your session.
That's because, to all intents and purposes you are the same person.
A stateless HTTP application HAS to authenticate against SOMETHING.
This report is bogus. Feel free to relabel it "Stateless HTTP
authentication potential vulnerability" and remove it from Invision
Power Board's category.
You finally answered, that is something. We can continue this
discussion here so you can't close
the topic like you did on the Invision Board site.
I will state again what the problem is:
1. Users behind a proxy that do not initiate the X-FORWARDED-FOR header
will all have the same
ipnumber.
2. A user using an OS that can close the Desktop session without
killing the applications like the browser
will possible still be logged in into the targeted Invision Board
site.
Both situations will make it easier to hijack the session once it is
installed on a server with tranparent sessions.
But you still need to see the session-id to be able to hijack the
session, and for that you need to see someones desktop. If, on the other
hand, you can guess session-id's in a reasonable timeframe (incremental
ID's, for example) and you don't care which session you steal then this
might be a real vulnerability, except that it also uses originating IP,
which you can't know if you're guessing the session id.
You stated that the user agent can be used for additional checks. Let
me state that it is very easy to fake that. Once you can get the
specific user to visit a site where the session id is disclosed you
have both the session id and the user agent.
Isn't that what's known as XSS? Granted, if you can get someone to post
the session-id to some site you control and then get the same IP as the
original user (you could simply spoof it and send blind queries fe).
This is not so different from phishing scams. If you can get someone to
enter his/her username and password on your site you'll own their
account too.
If Powerboard can be duped into including the session-id in a link to
some other site then it is a real vulnerability. Otherwise it isn't (or
rather, it isn't Powerboard specific, but a result of how HTTP sessions
work, just like Matt said).
At that moment you will be
able to login as that user _if_ you have the same ipnumber (behind a
proxy for instance).
Faking the user agent itself can be done with lots of tools or even at
the command line.
As for hiding the session id, in certain situations it will keep
showing up not matter what you do. Popups, javascript, etc.. You must
be absolutely sure this will not take place.
I think that's what he meant by "hiding the session-id".
One last thing, you might be right when you state that I do not know
how the board works, however, I do not need to know since the session
hijacking itself reveals how it works, you are not checking enough in
certain situations.
What do you suggest more to check? session-id and originating IP are the
only two variables available for authentication, unless you send the
username and password every time (http BasicAuth).
[ silly gauding removed ]
/exon
