Session ID not updated

Session ID not updated

Customer sessions and cookies may be stolen or manipulated, and they may be used to mimic legitimate users,
This allows hackers to view or change user records and perform transactions as the user

Possible causes
WEB application Programming or configuration is not secure
Technical description

When authenticating a user or otherwise establishing a new user session, if no existing session ID is invalidated, the attacker has the opportunity to
Steal a certified session. This scenario is typically observed in the following situations:

[1] The WEB application authenticates the user without first revoking the existing session, that is, continuing to use the session that has been associated with the user

[2] The attacker is able to enforce a known session identity to the user so that once the user authenticates, the attacker has access to the authenticated session

[3] The application or container uses a predictable session ID.

During a general exploration of a session-pinning vulnerability, an attacker creates a new session on the Web application and records the associated conversation identity.
The attacker then causes the victim to use the session ID to correlate to the server and possibly authenticate, so that the attacker can
Access the user's account through the active session. AppScan found that the session ID was not updated before and after the logon process, which means
The possibility of impersonating a user is likely to occur. A remote attacker who knows the session ID value beforehand can impersonate a legitimate user who is logged on.

Attack Flow:

A) The attacker uses the victim's browser to open the login form for the vulnerable site.

b) Once the form is opened, the attacker writes down the session ID value and waits.

c) When a victim logs on to a vulnerable site, its session ID is not updated.

D) The attacker could then use the session ID value to impersonate the victim and act as the user.

Session identity values can be exploited by leveraging cross-site scripting vulnerabilities that cause the victim's browser to contact a vulnerable site
obtained by using a predefined session ID) or by initiating a "session pinning" attack that will cause the site to provide a predefined session ID to the victim's browser.

Session ID not updated