PCI reports that I've seen show the cookie in question that they think you are using to identify your sessions.
The fact of the matter is how can the scanning company "know" what cookie values you are using to track sessions unless they can see your code. They can't unless they can successfully demonstrate a session highjacking with your server. That means they are guessing. That whole bit kind of irks me. I recently had a PCI scan that claimed I had the same problem. The thing was, the cookies their little automated scanner picked up had absolutely nothing to do with our session tracking and was a random cookie used only to help the load balancer keep server affinity. I was rather annoyed with that prognosis seeing as how any competent programmer worth his salt could look at my response headers and see the jsessionid in there, but a professional PCI compliance scanning company was charging us 600 dollars so their silly automatic scanner could pick up random cookies and assume they had anything at all to do with session tracking. Don't ask me how I really feel. :) So, what do you do? Well, firstly check the report again to see what cookies they think are you session ids. If you are using CFIDs, it probably picked that up because they are too dumb to read Adobe's technotes that clearly state CFID is NEVER used without CFTOKEN (which is random) to identify a session. (http://kb2.adobe.com/cps/404/kb404762.html) If you passed your scan, I wouldn't worry about it-- all you need is a passing grade. If you failed your scan and need to "fix" it, change to jssessionid and stop using CFID and CFTOKEN. If the cookie they are complaining about turns out NOT to be CFID, then consider refactoring so it is not in use or has a non-sequential value. Lastly, you can submit a rebuttal to them that basically says "You don't know what you're talking about and here's why", and they might not make it count against you. ~Brad ----- Original Message ----- From: "Deanna Schwint" <[email protected]> To: "cf-talk" <[email protected]> Sent: Monday, February 15, 2010 8:58 PM Subject: PCI Compliance Help > > We just had a PCI Compliance scan done through SecurityMetrics and have > one issue: > ---------------------------------------------------------------- > Synopsis: The remote web server generates predictable session IDs > Description: The remote web server generates a session ID for each > connection. A session ID is typically used to keep track of the actions of > a > user while he visits a web site. The remote server generates non-random > session IDs. An attacker might use this flaw to guess the session IDs of > other users and therefore steal their session. > ---------------------------------------------------------------- > We are using the UUID for CF Token that is set in the ColdFusion > administrator and are also setting : ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Want to reach the ColdFusion community with something they want? Let them know on the House of Fusion mailing lists Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:330761 Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
