We're dealing with a vulnerability where a forms authentication from one site can be used within a separate site. I can't figure out how is IIS or ASP.NET allowing this to occur
- Login to site1.domain.com as user "admin"
- Save authetication cookie value
- Go to site2.domain.com and use "EditThisCookie" extension to create a matching authentication cookie from step 2
- Submit that to bypass site2's authentication using site1's cookie (Logged in as "admin" on site2. Confirmed that I'm looking at site2's data - not some kind of alias of site1)
- 1 IIS Server (Windows 2016)
- 2 ASP.NET4 sites (site1.domain.com and site2.domain.com)
- site1 cookie name is SITE1_AUTH, and site2 cookie name is SITE2_AUTH
- using inproc session storage
- using separate application pools for site1 and site2
- cookies specify full domain ex: site1.domain.com (not domain.com)
- In the code it's using FormsAuthentication.SetAuthCookie()
- site1 and site2 have same user user1
I created a dummy test code to try to reproduce this issue using the relevant ASP.NET authentication code and web.config. I can't reproduce it in the dummy code though. It only works in the actual (large) application. For that reason I can't share the relevant source code, so I would be able to accept any hints for further exploration as a solution.