Sub-session hijacking on the web: Root causes and prevention

Abstract

Since cookies act as the only proof of a user identity, web sessions are particularly vulnerable to session hijacking attacks, where the browser run by a given user sends requests associated to the identity of another user. When n > 1 cookies are used to implement a session, there might actually be n sub-sessions running at the same website, where each cookie is used to retrieve part of the state information related to the session. Sub-session hijacking breaks the ideal view of the existence of a unique user session by selectively hijacking m sub-sessions, with m < n. This may reduce the security of the session to the security of its weakest sub-session. In this paper, we take a systematic look at the root causes of sub-session hijacking attacks and we introduce sub-session linking as a possible defense mechanism. Out of two flavors of sub-session linking desirable for security, which we call intra-scope and inter-scope sub-session linking respectively, only the former is relatively smooth to implement. Luckily, we also identify programming practices to void the need for inter-scope sub-session linking. We finally present Warden, a server-side proxy which automatically enforces intra-scope sub-session linking on incoming HTTP(S) requests, and we evaluate it in terms of protection, performances, backward compatibility and ease of deployment.

Shepherd: a Generic Approach to Automating Website Login

“…Furthermore, Shepherd could be extended to identify sites whose login system exhibits specific behaviour. One example could be sites that store session identifiers in local storage instead of using cookies; another is looking for sites vulnerable so sub-session hijacking [CRB19] (which relies on presence of multiple authentication cookies).…”

Less is Often More: Header Whitelisting as Semantic Gap Mitigation in HTTP-Based Software Systems

“…The HWL Proxy is implemented in Go and is available as open source 3 . Note that its standard http library was not used because it is subject to vulnerabilities as well [2].…”

“…In this section, we provide an overview of semantic gap vulnerabilities in HTTP message processing as defined in Section 2. Attacks based on semantic gaps in other application layers, such as processing multiple cookies [3], are out of scope.…”

Measuring Web Session Security at Scale

“…Analyzing web session security requires authenticated access to web applications, which is a difficult process to automate [4]. Thus, prior work on web session security reported on either (i) small-scale precise measurements involving a significant amount of manual effort [5,6,7], or (ii) large-scale measurements based on unauthenticated access to web applications, which miss valuable information, e.g., the login and logout processes [8]. The only notable exception is a recent paper, which analyzed post-login web session security at scale, but only focused on session hijacking enabled by cookie theft [9].…”

“…The only notable exception is a recent paper, which analyzed post-login web session security at scale, but only focused on session hijacking enabled by cookie theft [9]. This means that prior web security studies are too small in terms of analyzed sites [5,6,7], too imprecise because carried out without performing authentication [8] or too narrow because they only cover a limited set of web session security threats [9]; we further discuss and compare against prior work in Section 8.…”