[jboss-jira] [JBoss JIRA] (JBPORTAL-2495) Session Fixation

Wells guo created JBPORTAL-2495: ----------------------------------- Summary: Session Fixation Key: JBPORTAL-2495 URL: https://issues.jboss.org/browse/JBPORTAL-2495 Project: JBoss Portal Issue Type: Bug Security Level: Public (Everyone can see) Environment: EPP 5.1.0 Reporter: Wells guo Hi , Now our security team reported an issue Session Fixation : after user login project on machine A , if i copy cookie JSESSIONID to the machine B , the user on machineB can view the private content of the project , so do you have any advice about this issue , thanks ! Steps to Reproduce: 1. Get cookie from the browser on machine A. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cookie: JSESSIONID=DWQ6ztJvJeEZA77uVzE3Dg__ ^^^^^^^^^^^^^^^^^^^^^^^^ Connection: keep-alive Cache-Control: max-age=0 2. Clear cookie of browser on machine B. 3. Request project homepage on machine B and modify the set-cookie to A's cookie in the response. GET XXX HTTP/1.1 Host: XXXXXX User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:18.0) Gecko/20100101 Firefox/18.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive HTTP/1.1 200 OK Date: Thu, 15 Aug 2013 10:45:23 GMT X-Powered-By: Servlet 2.5; JBoss-5.0/JBossWeb-2.1 Set-Cookie: JSESSIONID=DWQ6ztJvJeEZA77uVzE3Dg__; Path=/; Secure ^^^^^^^^^^^^^^^^^^^^^^^^^ Cache-Control: no-cache Content-Type: text/html;charset=UTF-8 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Length: 24896 4. Login in browser of machine B. Actual results: Both machine A and B login the project successfully. Expected results: Machine A should not login without providing any credential. Additional info: Attacker can modify user's cookie by sending a malicious link to user. -- This message is automatically generated by JIRA. If you think it was sent incorrectly, please contact your JIRA administrators For more information on JIRA, see: http://www.atlassian.com/software/jira