[
https://issues.apache.org/jira/browse/WW-5841?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Gouri Sankar A updated WW-5841:
-------------------------------
Description:
StrutsBootServer embeds Tomcat and does not set a session tracking mode, so the
context
falls back to Tomcat's default of COOKIE and URL. The session cookie also has
no SameSite
attribute.
Effects on main:
- A session id sent in the URL (/app.action;jsessionid=<id>) is accepted as the
session.
- Tomcat's encodeURL appends ;jsessionid=<id> to links generated by <s:url> and
<s:a>,
which puts the session id in rendered pages and in Referer headers.
- Set-Cookie for JSESSIONID carries no SameSite attribute.
Fix: restrict the context to cookie-only session tracking and set SameSite=Lax
on the
session cookie. THREAT_MODEL.md section 5 lists both as Boot defaults.
Secure is not forced, because the embedded connector is plain HTTP
was:
Without a web.xml, the embedded Tomcat context StrutsBootServer starts
defaulted to the servlet-spec COOKIE+URL session tracking modes, so a session
id supplied only via ";jsessionid=" in the URL (no cookie at all) was accepted
and kept alive with no fresh Set-Cookie -- a session-fixation vector.
Live-reproduced before this fix: a session established by cookie was resumed by
replaying the id via the URL parameter with no Cookie header sent at all.
Fix restricts session tracking to COOKIE only, and the session cookie now
carries SameSite=Lax (previously unset). Secure is deliberately not forced:
Boot opens a plain HTTP listener by default, and an operator terminating TLS in
front of it sets Secure themselves, as with any other servlet container.
Boot is part of 7.5.0 (unreleased, no production deployments yet), so this
lands before anyone is exposed to it.
Tests: StrutsBootTomcatTest gains testSessionCookieHasSameSiteLax and a
URL-supplied-session-id-is-not-honoured test, with a
cookie-based-session-still-works control. Full boot suite: 52/0 failures.
> Struts Boot accepts a session id via URL ;jsessionid= with no cookie and no
> SameSite
> ------------------------------------------------------------------------------------
>
> Key: WW-5841
> URL: https://issues.apache.org/jira/browse/WW-5841
> Project: Struts 2
> Issue Type: Improvement
> Components: Core
> Reporter: Gouri Sankar A
> Priority: Minor
> Fix For: 7.5.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> StrutsBootServer embeds Tomcat and does not set a session tracking mode, so
> the context
> falls back to Tomcat's default of COOKIE and URL. The session cookie also has
> no SameSite
> attribute.
> Effects on main:
> - A session id sent in the URL (/app.action;jsessionid=<id>) is accepted as
> the session.
> - Tomcat's encodeURL appends ;jsessionid=<id> to links generated by <s:url>
> and <s:a>,
> which puts the session id in rendered pages and in Referer headers.
> - Set-Cookie for JSESSIONID carries no SameSite attribute.
> Fix: restrict the context to cookie-only session tracking and set
> SameSite=Lax on the
> session cookie. THREAT_MODEL.md section 5 lists both as Boot defaults.
> Secure is not forced, because the embedded connector is plain HTTP
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
