Geek Park official website administrator Cookie leakage directly into the background and Solution

Geek Park official website administrator Cookie leakage directly into the background and Solution

 

Geekpark.net

A few months ago, the WooYun salon connected the same WiFi with the reporter sister of geek Park and caught her Cookie with the dSploit of the mobile phone.

I thought there was no need to report it, but today I saw the pig vulnerability and tested it with my own hands. The Cookie was valid more than three months ago!

Defects:

1. The original Cookie is not valid after the user logs out.

2. The Cookie does not have a set expiration time or the expiration time is too long.

Risks:

1. Once the Administrator's Cookie is obtained, the official website can be controlled for a long time.

2. reduces the cost of using possible XSS vulnerabilities (otherwise, you may need to Keep-Alive to ensure Cookie effectiveness)
 

 

My sister is still using MacBook ~
 

 

50000 users, which can be modified at will.
 

 

Solution:

1. Introduce the Cookie invalidation mechanism (the original Cookie becomes invalid after cancellation, and set the expiration time for the Cookie)

2. Strengthen the reporter's security awareness (pay attention to the security risks caused by unfamiliar WiFi)