2

We're dealing with a vulnerability where a forms authentication from one site can be used within a separate site. I can't figure out how is IIS or ASP.NET allowing this to occur

Steps:

  1. Login to site1.domain.com as user "admin"
  2. Save authetication cookie value
  3. Go to site2.domain.com and use "EditThisCookie" extension to create a matching authentication cookie from step 2
  4. Submit that to bypass site2's authentication using site1's cookie (Logged in as "admin" on site2. Confirmed that I'm looking at site2's data - not some kind of alias of site1)

Environment:

  • 1 IIS Server (Windows 2016)
  • 2 ASP.NET4 sites (site1.domain.com and site2.domain.com)
  • site1 cookie name is SITE1_AUTH, and site2 cookie name is SITE2_AUTH
  • using inproc session storage
  • using separate application pools for site1 and site2
  • cookies specify full domain ex: site1.domain.com (not domain.com)
  • In the code it's using FormsAuthentication.SetAuthCookie()
  • site1 and site2 have same user user1

I created a dummy test code to try to reproduce this issue using the relevant ASP.NET authentication code and web.config. I can't reproduce it in the dummy code though. It only works in the actual (large) application. For that reason I can't share the relevant source code, so I would be able to accept any hints for further exploration as a solution.

  • Single login mechanism across the domain? – postoronnim May 23 at 14:55
  • The mechanism is the same type, but each site is it's own instance (separate usernames and passwords). In this case for example, there is admin on both site1 and site2 (each with it's unique password) – user3280964 May 23 at 15:24
6

The most likely reason is that a machineKey node is set in the web.config for each of the web applications, and the node has the same values for both. This node contains the key for encrypting and decrypting the authentication cookie, and by default (if the node doesn't exist) the server will create unique keys for each application. If, however, you specify a machineKey node (which, for instance, if you had a single web application with multiple web serves and you needed an auth cookie to be created or consumed on any arbitrary node) the key that you specify will be used. This can create a vulnerability if the same values are used on multiple web applications (or made public) because you end up with the situation you describe. A valid arbitrary authentication cookie from one application can be re-used as a forged authentication token for another application.

  • 2
    I confirmed that this was cause of the problem. As soon as I removed or changed the machineKey the problem disappeared. Thank you very much! – user3280964 May 24 at 0:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.