Session Hijacking in OpenAM via Unauthorized Session Query

Executive Summary

This vulnerability in OpenAM allows a low-privileged authenticated user to retrieve another user's active session credentials, including those of more privileged accounts, by exploiting insufficient authorization checks in the session management endpoint. The issue occurs when stateful session storage is used and the session management endpoint is exposed.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking OpenAM versions and monitoring for unusual session access patterns. Verify if your OpenAM version is below 16.1.1 using system commands like 'cat /path/to/openam/version.txt' or checking package managers. Inspect logs for repeated session queries from low-privileged accounts targeting other users' sessions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could hijack sessions of other users, including highly privileged accounts, leading to unauthorized access to sensitive data or administrative functions. Exploitation requires a valid low-privilege session and knowledge of a target user's identity identifier.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). Compromised sessions may expose confidential information or allow unauthorized modifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade OpenAM to version 16.1.1 or later. If upgrading is not possible, restrict access to the session management endpoint via network controls or disable stateful session storage if feasible. Monitor for suspicious session access attempts and revoke potentially compromised sessions.

Useful 0 Not Useful 0