the-web-application-hackers-handbook

246 Chapter 7 n Attacking Session Management
real-world blog applications), a malicious blogger can steal the session tokens
of other users in the same way as is done in a stored cross-site scripting attack
(see Chapter 12).
The problem arises because user-authored blogs are created as subdomains
of the main application that handles authentication and session management.
There is no facility within HTTP cookies for the application to prevent cookies
issued by the main domain from being resubmitted to its subdomains.
The solution is to use a different domain name for the main application (for
example, www.wahh-blogs.com) and to scope the domain of its session token
cookies to this fully qualified name. The session cookie will not then be submitted
when a logged-in user browses the blogs of other users.
A different version of this vulnerability arises when an application explicitly
sets the domain scope of its cookies to a parent domain. For example, suppose
that a security-critical application is located at the domain sensitiveapp
.wahh-organization.com. When it sets cookies, it explicitly liberalizes their
domain scope, as follows:
Set-cookie: sessionId=12df098ad809a5219; domain=wahh-organization.com
The consequence of this is that the sensitive application’s session token cookies
will be submitted when a user visits every subdomain used by wahh-organization
.com, including:
www.wahh-organization.com
testapp.wahh-organization.com
Although these other applications may all belong to the same organization as
the sensitive application, it is undesirable for the sensitive application’s cookies
to be submitted to other applications, for several reasons:
n The personnel responsible for the other applications may have a different
level of trust than those responsible for the sensitive application.
n The other applications may contain functionality that enables third parties
to obtain the value of cookies submitted to the application, as in the
previous blogging example.
n The other applications may not have been subjected to the same security
standards or testing as the sensitive application (because they are less
important, do not handle sensitive data, or have been created only for test
purposes). Many kinds of vulnerability that may exist in those applications
(for example, cross-site scripting vulnerabilities) may be irrelevant
to the security posture of those applications. But they could enable an
external attacker to leverage an insecure application to capture session
tokens created by the sensitive application.