What is Insufficient Session Expiration?

Definition

Insufficient Session Expiration is a security vulnerability where session duration is not adequately configured, allowing sessions to remain active for an extended period. This can enable attackers to exploit stolen sessions or allow unauthorized access even after a user has logged out.

Vulnerable Points of Occurrence

• All pages that require a session.

Vulnerability Verification Method

• Accessing the "My Page" while logged out to check if the session persists.

Attack Method

Attack Scenario

1. The attacker identifies that sessions are persisting for an extended period due to insufficient session expiration settings.
2. Even after a user logs out, if the session remains valid, the attacker can exploit the stolen session to access the application while impersonating the user.
3. The attacker can then perform illegal actions or abuse the user's privileges.

Event Flow

Detailed Process Explanation

1. The user initiates a logout request to the application.
2. The application handles the logout request and expires the session.
3. However, due to insufficient session expiration settings, the session remains valid.
4. The attacker utilizes the stolen session to send requests to the application.
5. The application processes the attacker's request.

Mitigation Measures

• Implement proper session expiration settings. Set session validity periods and automatically expire sessions based on user inactivity.
• Handle session expiration appropriately when a user logs out.

Cybersecurity: What is Weak Password Recovery?

Definition

Weak Password Recovery is a security vulnerability where the function to recover a forgotten password is poorly implemented, allowing malicious attackers to guess or gain access through brute force attacks.

Vulnerability Points

• Password reset pages

Vulnerability Testing Methods

• Verify if the password is exposed during the password reset process.
• Check if the password, when sent to a phone number or email, can still be delivered even if it's tampered with.

Attack Methods

Attack Scenario

1. The attacker exploits the feature provided for users to recover forgotten passwords.
2. Using weak security procedures or vulnerable reset links/tokens, the attacker bypasses the password reset process or sets arbitrary passwords.
3. The attacker gains access to the user's account through guessing or brute force attacks.

Occurrence Process

Detailed Explanation

1. The user requests a password recovery from the application.
2. The application provides a reset link or token to the user.
3. The user completes the reset procedure and changes the password.
4. The attacker requests password recovery with weak security procedures.
5. The application allows the attacker's request and permits password reset.

Countermeasures

• Implement robust password reset procedures. Verify email addresses and require additional trustworthy authentication steps.
• Limit the validity period of temporary passwords and enforce the necessity of setting a new password.
• Strengthen security questions and answers. Avoid using weak security questions and ensure answers are not easily predictable.
• Implement email verification securely. Use ownership verification for email addresses or additional security authentication methods.