Broken Authentication And Session Management
Broken Authentication and Session Management
Overview of the Vulnerability
Broken authentication and session management vulnerabilities exist when a user is able to access resources or perform actions not intended for their user role. Identity and access controls can be bypassed through a variety of ways including but not limited to, calling an internal post authentication page, modifying the given URL parameters, by manipulating the form, or by counterfeiting sessions.
This application has authentication and session management controls which an attacker can bypass to access a user account. The attacker is only limited by the permissions of the user account they access, including Administrator users. This could include viewing or editing sensitive customer data, viewing or editing other user permissions, and taking over other user accounts or elevating privileges.
Business Impact
Broken authentication and session management could lead to data theft through the attacker’s ability to manipulate data through their access to the application, and their ability to interact with other users, including performing other malicious attacks, which would appear to originate from a legitimate user. These malicious actions could also result in reputational damage for the business through the impact to customers’ trust.
Steps to Reproduce
Enable a HTTP interception proxy, such as Burp Suite or OWASP ZAP
Use a browser to navigate to: {{URL}}
Forward the following request to the endpoint:
{{request}}Observe that the authentication method or session management has been compromised in some way
Proof of Concept (PoC)
The screenshot below demonstrates the broken authentication and session management:
{{screenshot}}
Guidance
Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed triage time and result in faster rewards.
For a broken authentication or session management vulnerability, please include a simple URL or HTTP payload that can be executed to easily demonstrate and reproduce the issue.
Attempt to escalate the broken authentication or session management to perform additional actions (such as an account takeover or CSRF bypass to perform a sensitive action). If this is possible, provide a full Proof of Concept (PoC).
Recommendation(s)
Authentication bypass can be remediated by implementing a handful of best practices relating to authentication and session management to ensure secure implementation. These include:
Keeping all systems, software and operating systems up-to-date with a repeatable patch management process
Validate all user input server-side
Ensure that the authentication mechanisms and logic are robust and that each request for a resource passes through an authorization process
The verification logic of the application, as well as all of the above, should be thoroughly tested during the development and QA phases of an application build.
For further information, refer to Open Web Application Security Project(OWASP) guides located at:
Last updated