Req #66947 [Opn]: Session fixation with use_strict_mode on custom save handlers

Edit report at https://bugs.php.net/bug.php?id=66947&edit=1 ID: 66947 User updated by: ondrej dot machulda at gmail dot com Reported by: ondrej dot machulda at gmail dot com Summary: Session fixation with use_strict_mode on custom save handlers Status: Open Type: Feature/Change Request Package: Session related PHP Version: 5.5.10 Block user comment: N Private report: N New Comment: Related documentation bug: https://bugs.php.net/bug.php?id=66951 Previous Comments: ------------------------------------------------------------------------ [2014-03-24 22:10:37] ondrej dot machulda at gmail dot com To be accurate, I missed the mm handler, which also includes the strict mode check. But not the user handler. So the point is still there - you could enable the setting and assume you are protected (because it is written in the manual). But if you use a custom session save handler, you are in fact not at all. And this is not really obvious - session *save* handler should be by definition just an adapter containing logic for saving and reading session, but care about spoofing SID should by IMO implemented more low-level. I'll try to send PR to update the manual at least. But for me, this is still a bug, not expected behavior. ------------------------------------------------------------------------ [2014-03-24 18:34:03] stas@php.net I would think this is for save handler authors to implement necessary code to support user_strict_mode. If you have an idea how to improve the functionality, you're welcome to submit pull/RFC, however I do not think that if some custom handler does not implement this capability this implies a security bug in PHP. ------------------------------------------------------------------------ [2014-03-24 15:52:38] ondrej dot machulda at gmail dot com Description: ------------ PHP 5.5.2 introduced session.use_strict_mode settings, which, if enabled, rejects uninitialized session IDs provided by the client and regenerate the SID with a new one. This protect user from one kind of session fixation attack, see CVE-2011-4718 The manual states: session.use_strict_mode specifies whether the module will use strict session id mode. If this mode is enabled, the module does not accept uninitialized session ID. If uninitialized session ID is sent from browser, new session ID is sent to browser. Applications are protected from session fixation via session adoption with strict mode. Defaults to 0 (disabled). However, the strict mode is only implemented in mod_files (https://github.com/php/php-src/search?q=use_strict_mode&type=Code), thus using any custom session save handler (for eg. memcache, redis, database...) will keep you with this vulnerability exploitable. I see two problems there: 1) The configuration option may confuse you to think you are protected (no matter the session save handler you use), what is apparently not true. 2) IMHO the strict mode could be done handler-agnostic, for example modifying SessionHandlerInterface to require validate() method or something. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66947&edit=1