Articles Thread, [20090101] - Core - JSession SSL Session Disclosure in Joomla; [20090101] - Core - JSession SSL Session Disclosure Project: Joomla! SubProject: framework Severity: Low Versions: 1.5.8 and all previous 1.5 ...

Short Link: http://forum.egypt.com/enforum/showthread.php?t=18808

Developer · 19-01-2009, 01:19 PM

[20090101] - Core - JSession SSL Session Disclosure

Project: Joomla!
SubProject: framework
Severity: Low
Versions: 1.5.8 and all previous 1.5 releases
Exploit type: Session Hijacking/
Reported Date: 2008-November-20
Fixed Date: 2009-January-9

Description

When running a site under SSL ONLY (the entire site is forced to be under ssl), Joomla! does not set the SSL flag on the cookie. This can allow someone monitoring the network to find the cookie related to the session. Please note that all data is still transferred securely.
Affected Installs

1.5.8 and lower installs which are run with SSL only (no non-ssl access).
Solution

Upgrade to latest Joomla! version (1.5.9 or newer), and set force_ssl in global configuration. Alternatively, the php setting session.secure_cookie can be set in .htaccess or php.ini. Joomla! (all versions) will respect this setting.
Reported By Hanno Boeck

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Articles Thread, [20090101] - Core - JSession SSL Session Disclosure in Joomla; [20090101] - Core - JSession SSL Session Disclosure Project: Joomla! SubProject: framework Severity: Low Versions: 1.5.8 and all previous 1.5 ... Short Link: http://forum.egypt.com/enforum/showthread.php?t=18808