Security Observation - Session Hijacking / Improper Session Validation

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)
• CA Unified Infrastructure Management On-Premise (Nimsoft / UIM)
• CA Unified Infrastructure Management SaaS (Nimsoft / UIM)

Issue/Introduction

UIM 20.3.3 no hot fixes

Company  was able to replay a session from another company  user on https://<ip>/adminconsoleapp/ by only obtaining another user’s JSESSIONID.

Impact	This vulnerability can allow a malicious attacker to use this application of the user of which they have stolen the session id from. This session will last until the original user logs out or the session timeouts. During this time, an attacker could perform actions within this application with the roles / permissions of the original user. Different attack vectors a malicious actor may use to steal a user's authenticated session id could be via cross-site scripting attacks, hidden form fields on a webpage, browser exploitation, or a social engineering attack.
Systems Affected	URL: ·        https://<##.##.##.##>/adminconsoleapp/
Recommendation	Implement proper session validation techniques such as: ·        Including other tokens / factors for authentication such as anti-CSRF tokens. ·        Setting the secure flag for the JSESSIONID cookie so it cannot be transmitted over cleartext HTTP. ·        Enforcing sticky sessions (by verifying the relationship between the session ID and other client properties, like the IP address or User-Agent). ·        Set appropriate values for the Expire and Max-Age attributes of the JSESSIONID cookie.

 

 

 

Environment

• Release: 20.3
• Component: UIM - SECURITY VULNERABILITIES

Resolution

Resolved in UIM 20.4 to be released in September 2021.