CVE-2020-10714: Session Fixation in WildFly Elytron
Summary
CVE-2020-10714: Session Fixation in WildFly Elytron. Affects org.wildfly.security:wildfly-elytron versions < 1.11.4. Fixed in 1.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
WildFly Elytron is a security framework used in the WildFly application server to provide authentication, authorization, and other security services. It is designed to be flexible and extensible, allowing developers to customize security configurations for their applications. However, a vulnerability has been discovered in versions 1.11.3.Final and earlier, which could lead to a session fixation attack when using WildFly Elytron FORM authentication with a session ID in the URL.
Vulnerability Detail
The vulnerability allows an attacker to fixate a user's session ID, potentially gaining unauthorized access to the user's account and compromising data confidentiality, integrity, and system availability. By manipulating the session ID in the URL, an attacker can force a user to use a specific session, allowing them to impersonate the user and perform actions on their behalf. This can lead to various security breaches and unauthorized activities.
How To Fix
Minimum fixed version
1.11.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to disable the use of session IDs in the URL and rely solely on cookies for session management. This can be achieved by configuring the application server to remove the 'jsessionid' parameter from the URL and enforce the use of cookies for session tracking.
Conclusion
In conclusion, the vulnerability in WildFly Elytron allows for session fixation attacks, potentially leading to unauthorized access and data breaches. It is crucial to upgrade to the latest version or apply the recommended workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.wildfly.security:wildfly-elytron →
FAQ
WildFly Elytron is a security framework used in the WildFly application server to provide authentication, authorization, and other security services.
Session fixation is an attack where an attacker fixes or sets a user's session ID, allowing them to hijack the user's session and impersonate them.
This vulnerability can lead to unauthorized access to user accounts, compromising data confidentiality, integrity, and system availability.
To fix this vulnerability, upgrade to WildFly Elytron version 1.11.4 or later. Alternatively, disable session IDs in the URL and rely on cookies for session management.
Yes, a temporary workaround is to disable the use of session IDs in the URL and enforce the use of cookies for session tracking.
Related vulnerabilities
Recent vulnerabilities recorded for org.wildfly.security:wildfly-elytron.
