Session Fixation in CallBackery via X-Session-Cookie Header

Executive Summary

CallBackery versions before 0.62.0 for Perl have a flaw where session cookies sent in the X-Session-Cookie header are accepted regardless of age. The cookieConf() function only rejects cookies older than 300 seconds if they arrive via the xsc query parameter, not through the X-Session-Cookie header. This allows indefinitely old session cookies to authenticate users.

Useful 0 Not Useful 0

Detection Guidance

Check for session cookies sent via the X-Session-Cookie header in HTTP requests. Monitor logs for cookies older than 300 seconds appearing in this header, as they should be rejected but are currently accepted.

Useful 0 Not Useful 0

Impact Analysis

If a session cookie leaks through logs, Referer headers, or browser history, an attacker could reuse it to impersonate the user indefinitely. This grants unauthorized access to the system as long as the cookie remains valid.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It undermines access control measures, potentially resulting in non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Update CallBackery to version 0.62.0 or later to fix the session cookie validation issue. Ensure session cookies are only accepted via the xsc query parameter and rejected if older than 300 seconds.

Useful 0 Not Useful 0