VNX-384: Session Fixation

Field	Value
Rule ID	VNX-384
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java, XML
CWE	CWE-384
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	session-fixation cwe-384
Source	internal/sast/rules/vnx-384.rego

Overview

VNX-384 maps to CWE-384: Session Fixation. It reports:

• Spring Security configured to keep the pre-login session: sessionFixation().none(), sessionFixation(f -> f.none()), SessionFixationConfigurer::none, and session-fixation-protection="none" in XML;
• a servlet or controller method that checks credentials (it mentions a password, authenticate, checkPassword, login or credentials) and then stores the identity in the existing session (setAttribute with a key such as user, userId, loggedIn, principal, role, or a constant such as SESSION_USER) without calling session.invalidate() or request.changeSessionId() earlier in the method.

Not reported: migrateSession(), newSession() and changeSessionId() configuration (Spring’s default protects), a method that rotates or invalidates the session first, attributes unrelated to identity (cart, locale), methods that check no credentials, comments, string literals and test code.

Why This Matters

If the session id stays the same across login, an attacker who planted a known id in the victim’s browser (through a link, a subdomain cookie or a shared machine) is logged in as the victim the moment the victim signs in.

What Gets Flagged

http.sessionManagement().sessionFixation().none();               // FLAGGED

if (users.checkPassword(name, password)) {
    HttpSession session = req.getSession();
    session.setAttribute("user", user);                          // FLAGGED
}

<session-management session-fixation-protection="none"/>        <!-- FLAGGED -->

Not flagged: req.changeSessionId(); or req.getSession().invalidate(); before the setAttribute, sessionFixation().migrateSession(), session.setAttribute("cart", cart).

Remediation

1. Keep Spring Security’s default (changeSessionId) or use migrateSession().
2. In servlet code, call request.changeSessionId() (or invalidate the old session and create a new one) immediately after the credentials are verified and before storing the user.

References

• CWE-384: Session Fixation
• OWASP Session Management Cheat Sheet

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-384
// nosec vnx-384

Or record an ignore rule: vulnetix ignore add --rule vnx-384 --reason "...". See Suppressing findings.