SAP J2EE Engine Session Fixation Protection, SAP security note 1310561

SAP security note 1310561, "SAP J2EE Engine Session Fixation Protection", was released on 13.12.2010. Below are the symptom and SAP recommended solution.

Description

Symptom

A session fixation vulnerability in the SAP J2EE Engine can be exploited to gain access to authenticated user sessions. This allows an attacker to trick a user into using a session ID known to the attacker, providing unauthorized access when the user authenticates using that session ID.

Solution

• Upgrade to the latest version of the Engine. This fix depends on the fix from SAP Note 1175239 and requires applying the respective patch SAPJEECOR.SCA.
• Enable the session fixation protection mechanism. It is enabled by default in 7.11 SP06 and later, and in all service packs of 7.20 and 7.30.
  • For other versions, open Configtool.
  • Navigate to cluster-data > Global server configuration > services > servlet_jsp.
  • Click on the SessionIdRegenerationEnabled property.
  • In the Value field, type true.
  • Press the Set button in the top-right corner.
  • Press the Save button (diskette icon) in the top-left corner.
  • Confirm all popups.
  • Restart the server nodes for changes to take effect.

Reason and prerequisites

A session fixation vulnerability allows an attacker to trick a user into using a valid session ID known by the attacker. If the user authenticates with this session ID, the attacker gains access based on it. This vulnerability can affect any users, including administrators and regular users.

To prevent this vulnerability, it is strongly recommended to enable the SessionIdRegenerationEnabled property of the Web Container. Although this property is present in earlier service packs of the Engine, the session fixation protection handling has been significantly improved in the latest version of the Engine.

References