Session Fixation Attack Detection, SAP security note 1417679

SAP security note 1417679, "Session Fixation Attack Detection". Below are the symptom and SAP recommended solution.

Description

Symptom

When a session fixation attack is detected, the HTTP response returns a 403 Forbidden status with an error message similar to: "Possible session fixation attack detected! Contact your system administrator with a reference to SAP Note 1417679!"

This indicates that the system has identified potentially malicious activity involving session cookies.

Solution

For Case 1: The system correctly identifies and blocks the attacker using outdated cookies, while the legitimate user can continue their session uninterrupted.

For Case 2:

• Revise Implementation: Modify the application to avoid re-authentication during parallel requests. Implement an initial authentication followed by necessary parallel requests.
• Configure Authentication Stack: Ensure affected applications use the same authentication stack. Adjust the grace period for accepting parallel requests with outdated cookies as detailed in SAP Note 1464914.
• Adjust Session Fixation Protection: Change the Session Fixation Protection property to Grace Period (default is Strict). This allows the server to accept outdated session cookies within a short grace period post-authentication. Use this option cautiously and only with secure authentication mechanisms (e.g., x509 certificates).

Procedure for Options 2 and 3:

• Open SAP NetWeaver Administrator and navigate to /nwa/auth.
• Select Components.
• Choose the policy configuration of type Web for the affected application.
• On the Authentication Stack tab, click Edit. For Option 2, modify the Login Modules section; for Option 3, set Session Fixation Protection to Grace Period.
• Save the configuration.

Reason and prerequisites

This note is applicable only if:

• SAP Note 1310561 has been applied.
• The SessionIdRegenerationEnabled property in the servlet_jsp service is set to true.
• The described error appears as a symptom.

There are two primary scenarios where this error might occur:

• Case 1: Actual Session Fixation Attack – Two clients use identical session tokens (cookies) to access the same session. When one client authenticates, the session cookies are updated, causing the other client to lose access and receive a 403 error.
• Case 2: Parallel Requests Scenario – In applications where multiple parallel requests are made (e.g., multiple iFrames or portal interactions), some requests may trigger re-authentication. This results in outdated session cookies for some requests, erroneously being treated as malicious.

References

• SAP Note 1310561 – SAP J2EE Engine Session Fixation Protection
• SAP Note 1464914 – JSESSIONID cookie value is unexpectedly changed by the server
• SAP Note 1586827 – System hang (HTTP 503 session overload) with EOIO interfaces