J2EE session variables & Non Random Session IDs
our server keeps failing our pci compliance test due session id's being non random.
description: web server uses non random session ids synopsis: remote web server generates predictable session ids. impact: remote web server generates session id each connection. session id typically used keep track of actions of user while visits web site. remote server generates non-random session ids. attacker might use flaw guess session ids of other users , therefore steal session. see : http://pdos.csail.mit.edu/cookies/seq_sessionid.html data received: sending several requests gives following session ids : cfid=896744 cfid=896745 cfid=896746 cfid=896747 cfid=896748 resolution: configure remote site , cgis use random session ids. risk factor: medium/ cvss2 base score: 6.4 av:n/ac:l/au:n/c:p/i:p/a:n
we using though more secure option. there else have guarentee session id's non random or compliance test picking on false positive?
p.s. it's recent migration cf10, don't know if has it.
even if have jee sessions enabled, cf continue set cfid , cftoken cookies unless tell not to. use client scope.
if not using client scope can safely tell cf stop setting client cookies.
if using application.cfc add pseudocontstructor area:
<cfset this.setclientcookies = false />
if using applicaiton.cfm, begrudingly tell add <cfapplication /> tag
<cfapplication ... other settings... setclientcookies="false" />
if using client scope may out of luck , need reimplement whatever using client scope using session scope instead.
jason
More discussions in ColdFusion
adobe
Comments
Post a Comment