CWE-613 不充分的会话过期机制

Insufficient Session Expiration

结构: Simple

Abstraction: Base

状态: Incomplete

被利用可能性: unkown

基本描述

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 672 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 672 cwe_View_ID: 1003 cwe_Ordinal: Primary

  • cwe_Nature: CanPrecede cwe_CWE_ID: 287 cwe_View_ID: 1000

  • cwe_Nature: CanPrecede cwe_CWE_ID: 287 cwe_View_ID: 699

常见的影响

范围 影响 注释
Access Control Bypass Protection Mechanism

可能的缓解方案

Implementation

策略:

Set sessions/credentials expiration date.

示例代码

例

The following snippet was taken from a J2EE web.xml deployment descriptor in which the session-timeout parameter is explicitly defined (the default value depends on the container). In this case the value is set to -1, which means that a session will never expire.

bad Java

<web-app>
[...snipped...]

<session-config>
<session-timeout>-1</session-timeout>
</session-config>
</web-app>

Notes

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
WASC 47 Insufficient Session Expiration