Return-Path: <java-dev-return-95043-archive-asf-public=cust-asf.ponee.io@axis.apache.org>
X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io
Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io
Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183])
	by cust-asf2.ponee.io (Postfix) with ESMTP id DB5DB2009F3
	for <archive-asf-public-internal@cust-asf2.ponee.io>; Sat,  4 Jun 2016 14:44:00 +0200 (CEST)
Received: by cust-asf.ponee.io (Postfix)
	id D9FA4160A26; Sat,  4 Jun 2016 12:44:00 +0000 (UTC)
Delivered-To: archive-asf-public@cust-asf.ponee.io
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by cust-asf.ponee.io (Postfix) with SMTP id 2E9EB160A1E
	for <archive-asf-public@cust-asf.ponee.io>; Sat,  4 Jun 2016 14:44:00 +0200 (CEST)
Received: (qmail 82554 invoked by uid 500); 4 Jun 2016 12:43:59 -0000
Mailing-List: contact java-dev-help@axis.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:java-dev-help@axis.apache.org>
List-Unsubscribe: <mailto:java-dev-unsubscribe@axis.apache.org>
List-Post: <mailto:java-dev@axis.apache.org>
List-Id: <java-dev.axis.apache.org>
Reply-To: java-dev@axis.apache.org
Delivered-To: mailing list java-dev@axis.apache.org
Received: (qmail 82540 invoked by uid 99); 4 Jun 2016 12:43:59 -0000
Received: from arcas.apache.org (HELO arcas) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Sat, 04 Jun 2016 12:43:59 +0000
Received: from arcas.apache.org (localhost [127.0.0.1])
	by arcas (Postfix) with ESMTP id 251D62C1F5A
	for <java-dev@axis.apache.org>; Sat,  4 Jun 2016 12:43:59 +0000 (UTC)
Date: Sat, 4 Jun 2016 12:43:59 +0000 (UTC)
From: "Andreas Veithen (JIRA)" <jira@apache.org>
To: java-dev@axis.apache.org
Message-ID: <JIRA.12466912.1276531746000.33318.1465044239149@Atlassian.JIRA>
In-Reply-To: <JIRA.12466912.1276531746000@Atlassian.JIRA>
References: <JIRA.12466912.1276531746000@Atlassian.JIRA> <JIRA.12466912.1276531746894@arcas>
Subject: [jira] [Updated] (AXIS2-4739) Apache Axis2 Session Fixation
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394
archived-at: Sat, 04 Jun 2016 12:44:01 -0000


     [ https://issues.apache.org/jira/browse/AXIS2-4739?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andreas Veithen updated AXIS2-4739:
-----------------------------------
    Labels: security  (was: )

> Apache Axis2 Session Fixation
> -----------------------------
>
>                 Key: AXIS2-4739
>                 URL: https://issues.apache.org/jira/browse/AXIS2-4739
>             Project: Axis2
>          Issue Type: Bug
>    Affects Versions: 1.4.1, 1.5, 1.5.1
>         Environment: Tested on Linux Ubuntu & Debian. Other distributions may be vulnerable.
>            Reporter: Tiago Ferreira Barbosa
>            Assignee: Andreas Veithen
>            Priority: Critical
>              Labels: security
>
> We have found a Session Fixation Vulnerability in administrative interface of Apache Axis2. When successfully exploited, this vulnerability allows to fixate a session Cookie in the browser of the victim, this way it's possible to perform session hijacking attacks.
> The vulnerability was found in the administrative interface of Axis2. By default, it is accessible at the path /axis2/axis2-admin. To exploit this flaw, we used a Cross Site Script in existing Axis2 (http://www.exploit-db.com/exploits/12721/).
> Code Snippet:
> http://example:8080/axis2/axis2-admin/engagingglobally?submit=%2bEngage 2b&modules=<script>document.cookie="JSESSIONID=C958373831119190D2DC7838BA177980.tomcat1; 
> Path=/axis2";document.location="http://example:8080/axis2/axis2-admin/"</script>
> The above code when run on the victim's browser, fixates the session cookie sent by the attacker to it.
> To protect against session fixation, the HTTP session must be invalidated and recreated on login, giving the user a new session id. 



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

---------------------------------------------------------------------
To unsubscribe, e-mail: java-dev-unsubscribe@axis.apache.org
For additional commands, e-mail: java-dev-help@axis.apache.org