3

In my PHP code, I am generating an RSA keypair, sending the public key to the visitor and storing the private key in a session variable. Is it possible that an attacker might somehow be able to read the content of the session variable?

I know that someone might take over a session by hijacking it, but I have not been able to find out whether it is possible to access the variables of that session.

Thank you in advance.

  • I am curious what use there is in storing the private key on the server side and giving the client the public key. Since the public key can be public, what would happen if an attacker got another user's public key? – d1str0 Mar 7 '16 at 8:46
  • @d1str0 It doesn't matter if an attacker gets someone else's public key, im only interested in making sure that the attacker can't read the data that the other user is trying to send to the server. In my case I don't need to prevent the attacker from sending data as someone else. Does that clarify it? – Pascal Sommer Mar 7 '16 at 19:59
  • Sure. Just curious about the use case. – d1str0 Mar 7 '16 at 20:00
5

No. Generally, session data is only stored server-side and should not be readable by an attacker.

However, bad configurations or vulnerabilities in your code may lead to the disclosure of session content. Reading out the session content is likely not the most severe problem in these cases though.

Reading Session Data from a File

Session data is stored in the file system of the server (the location is determined by session.save_path). So anyone who can read files from the session directory can read session content. This may happen if:

  • you have a directory traversal vulnerability which allows the reading of files.
  • on badly configured shared hosts, the temporary directory that stores the sessions may be accessible by others.
  • you badly misconfigured your server, and session.save_path is publicly accessible
  • ...

Reading Session Data from $_SESSION

If an attacker can read variables, they can also read their $_SESSION global variable.

This will mainly happen when you have a code execution vulnerability, so you have other things to worry about then.

But one could imagine code that makes it possible to read out variables, a simple example may be print_r($$_GET['x']);.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.