Allowing an attacker to control or predict session identifier generation creates weak, guessable session IDs that enable hijacking and user impersonation.

Scenario: William's Control Over Session Identifier Generation

Envision a scenario where William, exploiting a critical aspect of session management, gains control over the generation of session identifiers or authorization tokens. He leverages this control to:

1. Predictability in Session IDs: By influencing session ID generation, William makes these identifiers predictable, allowing him to guess valid session IDs.
2. Creation of Weak Session Identifiers or Tokens: He generates session identifiers or tokens that are not sufficiently protected, random, or complex, making them easier to compromise.

Example

William infiltrates a web application's session management system. He manipulates the session ID generation algorithm to produce predictable IDs. For instance, he sets the IDs to increment sequentially. With this knowledge, William easily predicts and hijacks active sessions by guessing the next valid session ID, gaining unauthorized access to user accounts and sensitive data. Or he finds an unprotected endpoint (e.g., a cache) containing JWT tokens and can exchange them for new tokens with a payload of his choosing, allowing him to impersonate other users or escalate privileges.

Threat Modeling

STRIDE

This scenario maps primarily to STRIDE: Spoofing.

Spoofing is about impersonating a legitimate user or system. William manipulates session ID generation so he can predict valid session identifiers. By doing this, he can assume the identity of another user without knowing their credentials. The core threat is unauthorized impersonation, which is Spoofing.

What can go wrong?

Control over session ID generation can lead to session hijacking, unauthorized access, and potential breaches of user privacy and data security.

For more things that can go wrong, see the Common Attack Patterns related to this card in the table below.

What are we going to do about it?

In general, use the server or framework’s own session management controls, rather than creating custom code. The application should only recognize these session identifiers as valid, and the session identifier creation must always be done on a trusted system (e.g., server-side).

1. Ensure that session identifiers are generated using strong, cryptographically secure algorithms that produce random and complex IDs.
2. Regularly review and test the session ID generation process to ensure it remains robust against prediction and manipulation.
3. Implement additional security checks to detect and mitigate session hijacking attempts.

For detailed advice on how to mitigate threats related to the card, see the ASVS and OWASP Developer Guide requirements in the table below.