0

I visited this site where I was able to set the language in the main page. When I clicked on the language link I got an URL like site.com/index.php?lang=us and was redirected to the home page. On the navbar I could see the USA flag, and when I looked into the HTML code I saw the session value us in the image src.

So I went back to the main page and set the lang value to test, like site.com/index.php?lang=test, got redirected, and it really changed the session value. The image on the navbar didn't exist and it was showing nothing.

Could this kind of thing affect the site in some way?

|improve this question
  • What you describe has nothing to do with session fixation as your tag suggests (read about session fixation at OWASP). Moreover it has nothing to do with a user associated session at all and it does not show any security problem. In fact, it is a normal and common behavior to include some security irrelevant parameters like language in the URL. – Steffen Ullrich Apr 9 '17 at 8:09
  • I couldn't post in another tag, and I know that isn't correct, but with some explanation it could be clearly – Thiago Dias Apr 9 '17 at 18:21
2

The lang=us thingy isn't a session. The parts after the ? in an URL are what is called query parameters. As any other part of the URL, modifying them changes what page you get. That is normal and totally expected. It's no stranger than me being able to "manipulate" the content Google displays by changing whats after the q in https://google.com?q=test.

It seems like things you set the lang query parameter to is echoed back into the image src attribute, even if the value is not a valid language code. That is a bit sloppy, but it is not a security problem in and of itself.

However, if you do not do any cleaning of the query parameters before you echo them back into your HTML source you will be vulnerable to reflected cross site scripting (XSS) attacks. To know if the site you visited is vulnerable, you would need to do more tests.

To learn what a session actually is, check out this article. For information about how to secure them, read OWASP.

|improve this answer
  • it's a session, this query parameter creates a session, I could refresh the page countless times and the value that I defined previously is still there, no matter in what page am i – Thiago Dias Apr 9 '17 at 18:20
  • Ok, so it saves the value from the query parameter to the session. Still nothing strange about that. Thats a fairly standard way to deal with multi language sites. – Anders Apr 9 '17 at 18:40
1

Session is a term with various meanings. But in the context of web application security and especially your original tag session-fixation it means a user associated session, where this association is unique for a specific user (i.e. user is logged in) and specific access rights, like access to the mail or facebook account or similar of this user. In this context attacks which allow stealing or assigning a session are security problems since they allow misuse of the identity of the user, i.e. do actions with the permissions of the user.

But, the language as in your question is not used to uniquely identity a specific user and thus is not a session with the meaning described above. And stealing or faking the language does not result in misuse of the users identity or access permissions since the language is not unique to this specific identity or permissions. Thus it is not a security problem.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.