[JIRA] (JENKINS-61738) Session hijacking protection hardening

[wfollon...@cloudbees.com (JIRA)]

Title: Message Title

Wadeck Follonier created an issue   Jenkins / JENKINS-61738 Session hijacking protection hardening Issue Type: Improvement Assignee: Unassigned Components: core Created: 2020-03-30 09:15 Priority: Minor Reporter: Wadeck Follonier After the recent SECURITY-1774 published in https://jenkins.io/security/advisory/2020-03-25/, we are preventing the usage of semicolon in URL. In Jenkins they could potentially have a legitimate (but not really recommended) usage when included in item names. If you need to activate the escape hatch "jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath", and you are using a SecurityRealm that does not invalidate the session after authentication, you are vulnerable to a session hijacking attack. Of course, the SecurityRealm issue has to be reported as a vulnerability and then corrected. The problem is that you can trigger a URL in Jenkins with ";jsessionid=xxx" (only "available" in Tomcat). This ticket is about adding a "second" level of protection there (think defense in depth) by forcing the session to be tracked as a cookie (from default which is cookie+url). Add Comment   This message was sent by Atlassian Jira (v7.13.12#713012-sha1:6e07c38) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.205567.1585559723000.2434.1585559760097%40Atlassian.JIRA.