Hans Wolters wrote:
Matt, On 16-mrt-2006, at 15:55, matt@xxxxxxxxxxxxxxxxx wrote:This report is ridiculous and quite frankly shows that the author does not understand how IPB works.Yes, the author is correct in finding that if you: copy the user's IP address, copy the user's user-agent and copy the user's session ID then they can "hijack" your session.That's because, to all intents and purposes you are the same person. A stateless HTTP application HAS to authenticate against SOMETHING.This report is bogus. Feel free to relabel it "Stateless HTTP authentication potential vulnerability" and remove it from Invision Power Board's category.You finally answered, that is something. We can continue this discussion here so you can't closethe topic like you did on the Invision Board site. I will state again what the problem is:1. Users behind a proxy that do not initiate the X-FORWARDED-FOR header will all have the sameipnumber.2. A user using an OS that can close the Desktop session without killing the applications like the browser will possible still be logged in into the targeted Invision Board site.Both situations will make it easier to hijack the session once it is installed on a server with tranparent sessions.
But you still need to see the session-id to be able to hijack the session, and for that you need to see someones desktop. If, on the other hand, you can guess session-id's in a reasonable timeframe (incremental ID's, for example) and you don't care which session you steal then this might be a real vulnerability, except that it also uses originating IP, which you can't know if you're guessing the session id.
You stated that the user agent can be used for additional checks. Let me state that it is very easy to fake that. Once you can get the specific user to visit a site where the session id is disclosed you have both the session id and the user agent.
Isn't that what's known as XSS? Granted, if you can get someone to post the session-id to some site you control and then get the same IP as the original user (you could simply spoof it and send blind queries fe). This is not so different from phishing scams. If you can get someone to enter his/her username and password on your site you'll own their account too.
If Powerboard can be duped into including the session-id in a link to some other site then it is a real vulnerability. Otherwise it isn't (or rather, it isn't Powerboard specific, but a result of how HTTP sessions work, just like Matt said).
At that moment you will be able to login as that user _if_ you have the same ipnumber (behind a proxy for instance).Faking the user agent itself can be done with lots of tools or even at the command line.As for hiding the session id, in certain situations it will keep showing up not matter what you do. Popups, javascript, etc.. You must be absolutely sure this will not take place.
I think that's what he meant by "hiding the session-id".
One last thing, you might be right when you state that I do not know how the board works, however, I do not need to know since the session hijacking itself reveals how it works, you are not checking enough in certain situations.
What do you suggest more to check? session-id and originating IP are the only two variables available for authentication, unless you send the username and password every time (http BasicAuth).
[ silly gauding removed ] /exon