1799279 - Session Fixation

Status: RESOLVED INVALID

(Firefox :: Untriaged, defect)

Description

[Sandeep Kumar shukla]

Attachment: amazon login on firefox.mp4

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36

Steps to reproduce:

Login in any web application like Zoho mail, amazon, Flipkart etc in firefox latest version.
Export the session cookies.
Import the cookies in the firefox private browser and hit the URL of the website.
It is found that it is showing login without any credentials and doing all activities as a normal user.
This cookie can be used multiple times.

Actual results:

Session Fixation vulnerability found in the latest version of Firefox. In firefox older versions and other browsers like chrome, internet explorer and edge this vulnerability was not present.

Expected results:

Session Fixation is an attack that permits an attacker to hijack a valid user session. This attack fixes an established session on the victim's browser, so the attack starts before the user logs in. In this case, the attacker can fix the victim's session and access the subsequent logged-in session by re-using the victim’s old cookie (the victim’s cookie prior to login) without any knowledge of the username or password. This compromises the confidentiality and integrity of data stored within the application.
After exporting one-time cookies attacker always uses it to log in and do all types of activity as a normal user does after the login.

Comment 1

[Daniel Veditz [:dveditz]]

Session Fixation vulnerability found in the latest version of Firefox. In firefox older versions and other browsers like chrome, internet explorer and edge this vulnerability was not present.

All browsers work this way, and there has not been any change between new and old Firefox in how this is handled.

This is not "session fixation", this is you cloning your session locally. Session fixation is a remote attack.